AD Domain ServicesArchitecture & Design

Simulating AD attacks with Purple Team labs

November 14, 2025
Purple teaming in an Active Directory (AD) context is the discipline of running controlled, authorized attack simulations (red) while observing, tuning, and validating detection + response (blue). Done well, it turns vague goals like “improve AD security” into measurable outcomes: which attacks did we detect, how fast, with what signal quality, and what changed because of it. This guide…
Read more
Attack Techniques & Threat ModelingSecurity Operations for Identity

Using BloodHound to map privilege escalation

November 14, 2025
Using BloodHound to Map Privilege Escalation in Active Directory Privilege escalation in Active Directory (AD) rarely happens as a single “big misconfiguration.” It’s usually a chain: a little too much delegated access here, a leftover admin right there, an ACL that nobody remembers, and suddenly an attacker (or a red team) has a clean path to Domain Admin. …
Read more
AD Domain ServicesAuthentication & Protocols

Identifying unsecure SPN configurations

October 31, 2025
Identifying Insecure SPN Configurations in Active Directory (Detection + Fix Runbook) Service Principal Names (SPNs) are a core part of how Kerberos knows which service you’re trying to reach and which account should decrypt the service ticket. That also makes SPNs a high-signal control point for both security and reliability: weak service-account hygiene, legacy…
Read more
AD Domain ServicesArchitecture & Design

Detecting unauthorized domain replication

October 31, 2025
Unauthorized domain replication is one of the fastest ways for an attacker to turn “some access” into “total access.” If someone can trigger directory replication (or abuse replication rights) they can extract credential material (including password hashes) and move laterally at scale—often without noisy malware on domain controllers. What “unauthorized…
Read more
GPO FundamentalsGroup Policy & Endpoint Policy

Monitoring Group Policy for backdoors

October 31, 2025
Monitoring Group Policy for Backdoors (GPO Tampering Detection & Response) Group Policy is one of the most powerful configuration channels in Active Directory—and that’s exactly why attackers love it. If a threat actor gains the ability to edit a Group Policy Object (GPO) (or its SYSVOL content), they can push “legitimate” settings that…
Read more
Attack Techniques & Threat ModelingSecurity Operations for Identity

Detecting Pass-the-Hash attacks

October 31, 2025
Pass-the-Hash (PtH) is a credential abuse technique where an attacker uses a captured NTLM password hash to authenticate to other systems—without ever knowing the user’s plaintext password. In an Active Directory environment, PtH is primarily a lateral movement and privilege expansion tactic: once a usable hash is obtained (often from a workstation), the attacker pivots to servers, file…
Read more