AD Domain ServicesArchitecture & Design

How to detect Golden Ticket attacks

November 14, 2025
How to Detect Golden Ticket Attacks in Active Directory A Golden Ticket attack is one of the most damaging post-compromise techniques in Active Directory: an attacker forges a Kerberos Ticket Granting Ticket (TGT) using the KRBTGT account secret, then impersonates any user (often Domain Admin) to access domain resources while blending into “normal”…
Read more
Attack Techniques & Threat ModelingSecurity Operations for Identity

Using BloodHound to map privilege escalation

November 14, 2025
Using BloodHound to Map Privilege Escalation in Active Directory Privilege escalation in Active Directory (AD) rarely happens as a single “big misconfiguration.” It’s usually a chain: a little too much delegated access here, a leftover admin right there, an ACL that nobody remembers, and suddenly an attacker (or a red team) has a clean path to Domain Admin. …
Read more
AD Domain ServicesAuthentication & Protocols

Identifying unsecure SPN configurations

October 31, 2025
Identifying Insecure SPN Configurations in Active Directory (Detection + Fix Runbook) Service Principal Names (SPNs) are a core part of how Kerberos knows which service you’re trying to reach and which account should decrypt the service ticket. That also makes SPNs a high-signal control point for both security and reliability: weak service-account hygiene, legacy…
Read more
AD Domain ServicesArchitecture & Design

Detecting unauthorized domain replication

October 31, 2025
Unauthorized domain replication is one of the fastest ways for an attacker to turn “some access” into “total access.” If someone can trigger directory replication (or abuse replication rights) they can extract credential material (including password hashes) and move laterally at scale—often without noisy malware on domain controllers. What “unauthorized…
Read more
GPO FundamentalsGroup Policy & Endpoint Policy

Monitoring Group Policy for backdoors

October 31, 2025
Monitoring Group Policy for Backdoors (GPO Tampering Detection & Response) Group Policy is one of the most powerful configuration channels in Active Directory—and that’s exactly why attackers love it. If a threat actor gains the ability to edit a Group Policy Object (GPO) (or its SYSVOL content), they can push “legitimate” settings that…
Read more