From ac53a073809b09325d1b835eda470a4cb56c72cf Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:00:07 +0100 Subject: [PATCH 01/13] docs: make Active Directory guide introductions clearer --- .../active-directory-certificate-services-ad-cs-compromise.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-certificate-services-ad-cs-compromise.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-certificate-services-ad-cs-compromise.md index 775da06..11ca5b1 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-certificate-services-ad-cs-compromise.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-certificate-services-ad-cs-compromise.md @@ -1,6 +1,8 @@ # Active Directory Certificate Services (AD CS) Compromise -### **Introduction** +Investigate certificate issuance and authentication risks in Active Directory Certificate Services, including vulnerable templates and CA trust. + +## Background **Active Directory Certificate Services (AD CS)** is a Microsoft role that enables organisations to build and manage a Public Key Infrastructure (PKI). AD CS is often used to issue and manage certificates for secure communication, authentication, and encryption within a Windows environment. While AD CS is a powerful tool for securing an enterprise, misconfigurations or improper implementation can make it a prime target for attackers. From 23314a427c48781e4a338b0db2cbc804d33a9648 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:00:11 +0100 Subject: [PATCH 02/13] docs: make Active Directory guide introductions clearer --- .../ad-detections-and-mitigations/golden-certificate.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-certificate.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-certificate.md index 84ae1dd..7488733 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-certificate.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-certificate.md @@ -1,6 +1,8 @@ # Golden Certificate -### **Introduction** +Examine suspected abuse of a compromised certificate authority and the certificates an attacker may have issued. + +## Background A **Golden Certificate** is an advanced attack technique used to compromise Active Directory Certificate Services (AD CS). Similar to the **Golden Ticket** in Kerberos attacks, a Golden Certificate allows an attacker to forge a legitimate certificate that can be used to impersonate any user, escalate privileges, or maintain persistent access within a domain environment. The attack exploits the trust model of the Public Key Infrastructure (PKI) and the inherent design of certificates issued by AD CS. From fd7f9605692bc223d8c4a3cb37d5bf6f4aca104e Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:00:14 +0100 Subject: [PATCH 03/13] docs: make Active Directory guide introductions clearer --- .../ad-detections-and-mitigations/unconstrained-delegation.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/unconstrained-delegation.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/unconstrained-delegation.md index aa56520..c9f2914 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/unconstrained-delegation.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/unconstrained-delegation.md @@ -1,6 +1,8 @@ # Unconstrained Delegation -### **Introduction** +Review unconstrained Kerberos delegation exposure and investigate possible credential misuse on delegated hosts. + +## Background **Unconstrained delegation** is a feature in Microsoft Active Directory (AD) that allows a server or service to impersonate any user who authenticates to it. This is done by granting the server access to the user's Kerberos **Ticket-Granting Tickets (TGTs)**, which are stored in memory. While designed to support scenarios where a service needs to act on behalf of a user across multiple resources, unconstrained delegation introduces significant security risks if misconfigured or exploited by attackers. From 86be5b9e21c863ff468d0f490f7f8ca072764121 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:00:18 +0100 Subject: [PATCH 04/13] docs: make Active Directory guide introductions clearer --- .../microsoft-entra-connect-compromise.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/microsoft-entra-connect-compromise.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/microsoft-entra-connect-compromise.md index a839863..4dd2be3 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/microsoft-entra-connect-compromise.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/microsoft-entra-connect-compromise.md @@ -1,6 +1,8 @@ # Microsoft Entra Connect Compromise -### **Introduction** +Investigate suspicious changes and access involving Microsoft Entra Connect and hybrid identity synchronization. + +## Background Microsoft Entra Connect (formerly Azure AD Connect) is a critical tool for synchronising on-premises Active Directory (AD) with Azure Active Directory (Azure AD). It allows organisations to manage identities across hybrid environments seamlessly. A **Microsoft Entra Connect Compromise** occurs when attackers exploit misconfigurations, vulnerabilities, or compromised credentials related to the Entra Connect server or its components. Such compromises can enable adversaries to manipulate identity synchronisation, escalate privileges, or exfiltrate sensitive data. From 0e5a1afefbc34b2b606dc41f29d6d14981baa316 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:00:28 +0100 Subject: [PATCH 05/13] docs: make Active Directory guide introductions clearer --- .../machineaccountquota-compromise.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/machineaccountquota-compromise.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/machineaccountquota-compromise.md index 7f1a2f5..6ec7fc7 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/machineaccountquota-compromise.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/machineaccountquota-compromise.md @@ -1,6 +1,8 @@ # MachineAccountQuota Compromise -### **Introduction** +Review the risks of computer-account creation rights and suspicious machine account activity. + +## Background **MachineAccountQuota** is an attribute in Active Directory that specifies how many machine accounts a user can create in the domain. By default, this value is set to **10**, meaning any authenticated domain user can create up to 10 machine accounts without administrative privileges. While this setting supports certain use cases, it also introduces a security risk if exploited by attackers. From 8406860c4e75ee37780665899cb42406595a44ea Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:00:40 +0100 Subject: [PATCH 06/13] docs: make Active Directory guide introductions clearer --- .../security-identifier-sid-history-compromise.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/security-identifier-sid-history-compromise.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/security-identifier-sid-history-compromise.md index 5d78f87..e402b30 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/security-identifier-sid-history-compromise.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/security-identifier-sid-history-compromise.md @@ -1,6 +1,8 @@ # Security Identifier (SID) History Compromise -### **Introduction** +Investigate changes to SIDHistory and evidence of privilege misuse across trusted domains. + +## Background In Microsoft Active Directory (AD), the **Security Identifier (SID) History** attribute is used to maintain a record of SIDs from previous domains when objects like users or groups are migrated. This allows users to retain access to resources in the original domain without requiring reconfiguration. While SID History is essential for seamless domain migrations and consolidations, it can be exploited in a **SID History Compromise** attack. From 0170d51f481fb9fb2ef1f912bf78d1ed9426c82b Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:00:48 +0100 Subject: [PATCH 07/13] docs: make Active Directory guide introductions clearer --- .../ad-detections-and-mitigations/skeleton-key.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/skeleton-key.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/skeleton-key.md index f03ebc6..460450c 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/skeleton-key.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/skeleton-key.md @@ -1,6 +1,8 @@ # Skeleton Key -### **Introduction** +Investigate suspicious domain controller authentication behaviour consistent with possible authentication-package tampering. + +## Background The **Skeleton Key** attack is an advanced persistence technique targeting Microsoft Active Directory (AD) environments. It involves injecting a malicious patch into the Local Security Authority Subsystem Service (LSASS) process on a domain controller, allowing attackers to bypass authentication mechanisms. This creates a "skeleton key" password that works for any user account without altering existing credentials or logs. The attack is particularly dangerous because it enables covert and persistent access to all accounts within the domain. From 4a0d04b3debc2a86f8cc4646eaa925b236c2c132 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:00:54 +0100 Subject: [PATCH 08/13] docs: make Active Directory guide introductions clearer --- .../ad-detections-and-mitigations/dumping-ntds.dit.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/dumping-ntds.dit.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/dumping-ntds.dit.md index c4839bc..4b312f7 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/dumping-ntds.dit.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/dumping-ntds.dit.md @@ -1,6 +1,8 @@ # Dumping ntds.dit -### **Introduction** +Examine evidence of Active Directory database access or copying while preserving domain controller forensic evidence. + +## Background The **NTDS.dit** file is the Active Directory (AD) database that stores all directory information, including user account data, group memberships, and most critically, password hashes. Dumping the **NTDS.dit** file is a technique used by attackers to extract this sensitive information and gain unauthorised access to an organisation's domain. From 78f2866ddc1fd0ea70bbd07b99271049984451fa Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:00:58 +0100 Subject: [PATCH 09/13] docs: make Active Directory guide introductions clearer --- .../one-way-domain-trust-bypass.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/one-way-domain-trust-bypass.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/one-way-domain-trust-bypass.md index d0db439..29b48d5 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/one-way-domain-trust-bypass.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/one-way-domain-trust-bypass.md @@ -1,6 +1,8 @@ # One-way Domain Trust Bypass -### **Introduction** +Review cross-domain trust boundaries, permitted authentication and unexpected access across a one-way trust. + +## Background In multi-domain Active Directory (AD) environments, **one-way domain trust** is a mechanism that allows users in one domain (the trusted domain) to access resources in another domain (the trusting domain). This trust relationship is often used to facilitate resource sharing while maintaining administrative separation between domains. However, this setup can be exploited by attackers through a **one-way domain trust bypass**, enabling unauthorised access to resources in the trusting domain. This occurs when attackers abuse the trust relationship to escalate privileges, perform lateral movement, or access sensitive data. From 92b257d761ec0d7a16f636ed057337ca46590d32 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:01:05 +0100 Subject: [PATCH 10/13] docs: make Active Directory guide introductions clearer --- .../password-in-group-policy-preferences-gpp-compromise.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/password-in-group-policy-preferences-gpp-compromise.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/password-in-group-policy-preferences-gpp-compromise.md index 2eb4ec2..2c5d206 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/password-in-group-policy-preferences-gpp-compromise.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/password-in-group-policy-preferences-gpp-compromise.md @@ -1,6 +1,8 @@ # Password in Group Policy Preferences (GPP) Compromise -### **Introduction** +Identify legacy Group Policy Preferences credentials and assess potential exposure. + +## Background **Group Policy Preferences (GPP)** is a feature in Microsoft Active Directory that allows administrators to configure and deploy system settings, including mapped drives, scheduled tasks, and local user accounts, across domain-joined computers. GPP once supported the deployment of local accounts with embedded passwords stored in the policy files. However, these passwords were encrypted using a weak AES key that was published publicly by Microsoft. From 4ee7f7e4180b6ba266bcdb93fc3e60fe80c51f8e Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:01:35 +0100 Subject: [PATCH 11/13] docs: clarify Active Directory reference introductions --- .../golden-security-assertion-markup-language-saml.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-security-assertion-markup-language-saml.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-security-assertion-markup-language-saml.md index 6b84b30..e5ef956 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-security-assertion-markup-language-saml.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/golden-security-assertion-markup-language-saml.md @@ -1,6 +1,8 @@ # Golden Security Assertion Markup Language (SAML) -### Introduction +Investigate suspected federation signing-key compromise and potentially forged SAML assertions. + +## Background The **Golden SAML** attack is a sophisticated technique targeting federated identity systems that utilise Security Assertion Markup Language (SAML) for authentication. In this attack, adversaries exploit the trust relationship between identity providers (IdPs) and service providers (SPs) to forge authentication tokens. By compromising the private key of the IdP or gaining administrative access, attackers can create valid SAML assertions, impersonate any user (including administrators), and gain unauthorised access to federated services. This attack is particularly dangerous in cloud environments, such as Office 365, AWS, and GCP, where SAML is commonly used for single sign-on (SSO). From db2bbe50442a5cee6803d46d975901143d6cd8aa Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:01:39 +0100 Subject: [PATCH 12/13] docs: clarify Active Directory reference introductions --- .../active-directory-events-for-detecting-compromise.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-events-for-detecting-compromise.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-events-for-detecting-compromise.md index 9ce6117..aaebbfe 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-events-for-detecting-compromise.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-events-for-detecting-compromise.md @@ -1,5 +1,7 @@ # Active Directory Events for Detecting Compromise +Use domain controller security events as investigation leads, taking audit policy and event coverage into account. + Recommended event IDs to log and monitor to detect the Active Directory compromises detailed in the [Detect and Mitigate Active Directory Compromise](./) sections ### Domain Controller Events From df78fefb739da9059b41903d90fc4f53208740f4 Mon Sep 17 00:00:00 2001 From: RootGuard Date: Tue, 20 Oct 2026 20:01:41 +0100 Subject: [PATCH 13/13] docs: clarify Active Directory reference introductions --- .../active-directory-security-controls.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-security-controls.md b/detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-security-controls.md index 12494b6..66e74d5 100644 --- a/detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-security-controls.md +++ b/detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-security-controls.md @@ -1,6 +1,8 @@ # Active Directory Security Controls -### **Introduction** +Review Active Directory security controls and the evidence needed to assess their effectiveness. + +## Background Organisations with effective mitigation controls are better equipped to prevent, detect, and respond to cybersecurity threats. These controls include a mix of preventive measures, such as firewalls, endpoint protection, and intrusion prevention systems, as well as detective mechanisms like security information and event management (SIEM) systems and anomaly detection tools. By layering these defences, organisations create a robust security framework that minimises the likelihood of breaches while maintaining continuous visibility into their network. Regular vulnerability assessments, penetration testing, and timely patch management ensure that known vulnerabilities are promptly addressed, reducing exposure to attacks.