10 Active Directory Attacks Every SOC Analyst Must Know
Learn how attackers target passwords, Kerberos tickets, privileged groups and domain controllers—and how a Tier-1 analyst can recognise the evidence, establish scope and escalate correctly.
Active Directory is not merely a list of usernames and computers. In many enterprises, it is the control plane for authentication, privileged access, servers, applications and business data. If an attacker gains control of a highly privileged identity or the domain itself, a single endpoint compromise can become an organisation-wide incident.
For SOC analysts, the challenge is that identity attacks rarely appear as one obvious “Active Directory attack” alert. The evidence is distributed across domain-controller security events, endpoint telemetry, Kerberos activity, network connections, account changes and administrative actions. Strong analysts learn to correlate these signals instead of judging any event in isolation.
What You Will Learn
Table of Contents
- Why AD attacks matter
- The identity attack chain
- Password spraying
- Kerberoasting
- AS-REP roasting
- Credential dumping
- Pass-the-Hash
- Pass-the-Ticket
- DCSync
- Golden Ticket
- Privileged-group manipulation
- Group Policy abuse
- Event ID detection table
- SOC investigation scenario
- Defensive checklist
- Frequently asked questions
Why Active Directory Attacks Matter
Attackers target identity because valid credentials can make malicious activity look similar to normal administration. A stolen password, NTLM hash or Kerberos ticket may allow an attacker to authenticate, access remote systems, add privileges or persist without exploiting another software vulnerability.
Microsoft’s current Active Directory security guidance recommends reducing attack surface, applying least privilege, protecting privileged accounts and using secure administrative hosts. Microsoft also warns that privileged groups possess rights capable of making extensive changes across AD and domain-joined systems.
The Active Directory Identity Attack Chain
Not every incident follows the same sequence, but this simplified chain helps a Tier-1 analyst understand how one identity event may connect to a larger compromise:
The 10 Active Directory Attacks
Password spraying differs from a classic brute-force attack. Instead of trying many passwords against one account, the attacker tests a small number of commonly used passwords across many usernames. This approach may reduce account lockouts and make each individual account appear to have only a few failures.
False-positive considerations: misconfigured services, stale stored credentials, vulnerability scanners and shared infrastructure can create repeated failures. The pattern across users, source devices, timing and subsequent activity is more useful than a single threshold.
Kerberoasting abuses a normal Kerberos capability. An authenticated user can request a service ticket for an account associated with a Service Principal Name. If the service account uses a weak password or legacy encryption, the attacker may attempt to crack the captured ticket material offline.
MITRE’s current Kerberoasting detection strategy recommends examining anomalous Event ID 4769 activity, unusual service-ticket volume, RC4 use and service accounts requested outside their normal baseline.
Kerberos preauthentication normally requires an account to prove knowledge of its credential before the Key Distribution Center returns authentication material. If preauthentication is disabled for an account, an attacker may request material that can be subjected to offline password guessing.
Defensive priority: remove “Do not require Kerberos preauthentication” unless a documented legacy requirement exists, use strong managed credentials and monitor configuration changes.
Credential Dumping from Windows Systems
Credential material is extracted from memory or protected stores
After compromising a Windows device, an attacker may attempt to access credential material associated with LSASS or other operating-system stores. The objective may be plaintext credentials, NTLM hashes, Kerberos tickets or secrets that enable privilege escalation and lateral movement.
Endpoint telemetry is often more valuable than domain-controller events for the original credential-access action. Correlate EDR with later authentication from the compromised host.
Pass-the-Hash allows an attacker to authenticate to compatible Windows services using a captured password hash rather than the original plaintext password. It is commonly associated with lateral movement after local or domain credentials have been exposed.
Context matters: NTLM is still present in many legitimate environments. A detection should consider source trust, account privilege, destination sensitivity, logon type, process activity and whether the sequence matches approved administration.
In Pass-the-Ticket activity, an attacker uses stolen Kerberos authentication material to access resources without knowing the account’s password. Depending on the ticket and account, this can support lateral movement or access to a specific service.
Ticket-based activity is difficult to judge from a single event. Combine domain-controller events, endpoint telemetry, identity baselines and resource-access logs.
DCSync impersonates directory-replication behaviour. An attacker with powerful replication permissions may request password-related data from a domain controller without interactively logging on to the controller. Because legitimate domain controllers replicate, the critical question is whether the requesting identity and host should perform that activity.
A Golden Ticket is a forged Kerberos Ticket Granting Ticket created using compromised KRBTGT account material. It can allow an attacker to create authentication material representing highly privileged access and maintain persistence in the domain.
Golden Ticket investigations are usually beyond Tier-1 closure authority. A senior incident-response and identity team may need to assess domain-wide exposure and recovery. Resetting KRBTGT is a controlled operational procedure, not a casual Tier-1 action.
An attacker who compromises an account with directory permissions may add another identity to Domain Admins, Enterprise Admins, Administrators or another delegated group. The change may provide immediate privilege or establish persistence for later use.
Microsoft’s privileged accounts and groups guide explains that built-in privileged identities can perform extensive changes in Active Directory and on domain-joined systems.
Group Policy Abuse
A domain policy is modified to distribute malicious configuration
Group Policy can apply security settings, scripts, software and system configuration to many users or computers. If an attacker gains the ability to modify a high-impact Group Policy Object, the same central-management power can be abused for execution, persistence, weakened controls or large-scale disruption.
A GPO change is not malicious merely because it affects many systems. The analyst must compare the object, administrator, time, approved change and resulting configuration.
Windows Event IDs for Active Directory Attack Detection
Microsoft maintains an events-to-monitor reference and current advanced audit policy guidance. Your exact event availability depends on operating-system version, audit policy, object auditing, log collection and SIEM onboarding.
| Event ID | Meaning | SOC use |
|---|---|---|
| 4624 | Successful logon | Review logon type, authentication package, source, destination and account. |
| 4625 | Failed logon | Identify password spraying, brute force, stale credentials and source patterns. |
| 4648 | Logon attempted with explicit credentials | Correlate RunAs, scheduled tasks, administration and unusual credential use. |
| 4672 | Special privileges assigned to a new logon | Validate privileged sessions and correlate with the originating authentication. |
| 4688 | New process created | Review suspicious tools, scripts and parent-child process relationships. |
| 4719 | System audit policy changed | Detect attempts to reduce visibility or unauthorised policy modification. |
| 4720 / 4726 | User created / deleted | Investigate persistence accounts and suspicious identity lifecycle changes. |
| 4728 / 4732 / 4756 | Member added to security group | Monitor global, local and universal group membership changes. |
| 4738 | User account changed | Review account flags, profile changes and unexpected configuration updates. |
| 4768 | Kerberos TGT requested | Investigate authentication source, account, encryption and AS-REP patterns. |
| 4769 | Kerberos service ticket requested | Detect unusual service-ticket volume and possible Kerberoasting. |
| 4771 | Kerberos preauthentication failed | Support password-spraying and authentication-failure analysis. |
| 4662 | Operation performed on a directory object | Investigate replication-right use and sensitive object access when auditing exists. |
| 5136 | Directory service object modified | Review group, permission, GPO and other directory-object changes. |
For a wider event reference with beginner explanations, bookmark Windows Event IDs Every SOC Analyst Should Know.
Real SOC Scenario: From Password Spray to Domain Escalation
Alert sequence
The SIEM identifies failed logins across 34 accounts from one VPN source. Twenty minutes later, one account succeeds. The same identity then requests many Kerberos service tickets and is added to a privileged operations group.
How a strong Tier-1 analyst should respond
- Validate: confirm event times, data sources, alert rules and affected domain.
- Enrich: identify the VPN source, user, endpoint, privileged group and business owner.
- Build the timeline: correlate failed authentication, success, ticket activity and group change.
- Scope: search for the source across other accounts and for the user across endpoints, services and directory changes.
- Assess impact: identify whether privileged access was used after the group membership change.
- Escalate: provide a concise evidence summary and follow the identity-compromise playbook.
- Document: record queries, findings, timestamps, affected entities and actions taken.
Example escalation summary: “A single VPN source generated authentication failures across 34 accounts, followed by a successful login for one target. That identity then showed abnormal service-ticket requests and was added to a privileged group outside the approved change window. The sequence suggests credential compromise with possible privilege escalation. Scope currently includes one confirmed account, one VPN source and one privileged-group change; further endpoint and identity response is required.”
A Repeatable Tier-1 Investigation Method
- Confirm the signal: detection name, logic, source log, event time and data quality.
- Identify the entities: user, device, domain controller, source IP, service, group and object.
- Compare with baseline: normal source devices, administrative hours, authentication methods and service usage.
- Correlate telemetry: domain-controller events, EDR, VPN, firewall, DNS and identity-provider logs.
- Build before-and-after context: review activity before the first alert and after any successful authentication.
- Establish scope: search the same source, account, ticket, process or change across the environment.
- Decide and escalate: explain the evidence, uncertainty, affected assets, business risk and next action.
This workflow aligns naturally with the investigation skills in the SOC Analyst Tier-1 Interview Guide and the technique-mapping approach explained in the MITRE ATT&CK Beginner Guide.
Active Directory Defensive Checklist
Microsoft’s guidance for least-privilege administrative models recommends delegating the permissions needed for defined roles instead of giving broad domain-wide authority.
How to Practise These Skills Safely
Create an isolated Windows lab with one domain controller, one Windows client and a SIEM or log collector. Focus on defensive visibility:
- Enable and verify the required audit categories.
- Create approved test users and security groups.
- Generate normal and failed authentication events.
- Make an authorised group-membership change and review the evidence.
- Search Kerberos events and compare normal service-ticket behaviour.
- Build one timeline and write a Tier-1 escalation note.
- Create a detection rule for an unusual privileged-group addition.
Use the SOC Home Lab Beginner Guide to design a safe practice environment. If you want to strengthen investigation logic further, review Microsoft Defender XDR for SOC Analysts and PowerShell for SOC Analysts.
Common Detection Mistakes
| Mistake | Why it fails | Better approach |
|---|---|---|
| Treating every failed login as an attack | Users and services regularly mistype or retain old passwords. | Analyse source, targets, timing, failure reason and later success. |
| Calling every RC4 ticket Kerberoasting | Legacy applications may still use RC4. | Correlate ticket volume, requester, SPNs, baseline and endpoint evidence. |
| Watching only domain controllers | Credential access may begin on a workstation. | Correlate DC, EDR, network, VPN and identity-provider telemetry. |
| Ignoring approved changes | Legitimate administrators make sensitive changes. | Validate actor, ticket, time, endpoint and exact object modification. |
| Closing after the first explanation | A benign-looking event may sit inside a malicious sequence. | Review activity before and after the signal and establish scope. |
| Using fixed thresholds everywhere | Environment size and normal behaviour differ. | Combine thresholds with baselines, rarity and asset criticality. |
Frequently Asked Questions
Which Active Directory attack should a beginner learn first?
Start with password spraying and privileged-group changes because the concepts and Windows events are easier to understand. Then study Kerberos fundamentals before moving to Kerberoasting, Pass-the-Ticket and Golden Tickets.
Is Kerberoasting the same as stealing a password?
No. Kerberoasting requests service-ticket material that may be attacked offline. Whether the attacker recovers a usable credential depends on factors such as the service account password and encryption configuration.
What is the difference between Pass-the-Hash and Pass-the-Ticket?
Pass-the-Hash uses a stolen password hash with compatible authentication, commonly NTLM. Pass-the-Ticket uses stolen Kerberos ticket material. Both can enable access without knowing the user’s plaintext password.
Why is DCSync considered high risk?
DCSync abuses directory-replication rights to request credential-related data. Unexplained replication activity from a non-domain-controller system can indicate severe domain compromise and requires urgent escalation.
Can one Windows Event ID confirm an AD attack?
Usually not. Event IDs describe actions, and legitimate administration may generate similar records. Analysts should correlate actor, source, device, privilege, process, timing, change approval and follow-on activity.
Which logs are most important for AD monitoring?
Domain-controller security events are essential, but mature monitoring also includes EDR, PowerShell, DNS, firewall, VPN, identity-provider, server and application logs.
Do all organisations generate the same AD events?
No. Event availability and fields depend on Windows version, audit policy, object auditing, log retention, collection agents and SIEM configuration. Validate your own telemetry before writing detections.
Should Tier-1 analysts reset KRBTGT after a Golden Ticket alert?
No. KRBTGT recovery is a controlled, high-impact identity operation that must follow the organisation’s incident-response and Active Directory recovery procedures. Tier-1 should preserve evidence and escalate.
Can I learn AD detection without offensive tools?
Yes. Beginners can learn authentication, group changes, auditing, SIEM queries, timeline building and incident writing through authorised administrative actions and simulated log datasets.
How can I demonstrate Active Directory skills in an interview?
Explain a small lab, the events you collected, one detection you created, the evidence you reviewed and how you wrote an escalation note. Demonstrable investigation reasoning is stronger than listing attack names alone.
Conclusion: Follow the Identity Story
Active Directory attack detection is not about memorising ten dramatic names. It is about recognising how identities, devices, tickets, privileges and directory changes connect.
A strong SOC analyst asks:
- Who performed the action?
- From which device and network source?
- Was the identity expected to perform it?
- What happened before and after?
- Which users, services and systems are affected?
- Does the evidence require urgent containment or escalation?
Practise answering these questions with real Windows events in an authorised lab. That is how attack terminology becomes job-ready investigation skill.
Build Practical Active Directory and SOC Investigation Skills
CybersecurityTRAIN.com helps freshers and IT professionals learn SIEM monitoring, Windows events, identity attacks, phishing investigation, incident response, MITRE ATT&CK and Tier-1 escalation through practical, role-focused training.
WhatsApp or call: +91 98857 89887 | Email: trainings@thecyberseal.com
Training and career support can improve skills and interview readiness but cannot guarantee employment, promotion or salary outcomes.