CISA Details 17 Techniques Used to Compromise Microsoft Active Directory

CISA and five international cybersecurity agencies issued technical guidance detailing 17 attacker techniques targeting Microsoft Active Directory environments. The guidance covers abuse of Active Directory Domain Services (AD DS), Active Directory Certificate Services (AD CS), and Active Directory Federation Services (AD FS), including credential theft, Kerberos ticket forgery, directory-replication abuse, certificate abuse, privilege escalation, lateral movement, persistence, and hybrid-identity compromise.

The agencies warned that an Active Directory compromise can expose enterprise accounts, infrastructure, applications, email, and connected cloud services. They recommend designating domain controllers, certificate authorities, AD FS servers, and Microsoft Entra Connect as Tier 0 assets; hardening authentication, delegation, certificate, and service-account configurations; and centrally collecting and baselining authentication, directory, certificate, and synchronization logs to detect malicious activity that can resemble legitimate administration.