Editorial batch 02: clarify legacy Active Directory detection introductions

detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-certificate-services-ad-cs-compromise.md

@@ -1,6 +1,8 @@
 # Active Directory Certificate Services (AD CS) Compromise
 
-### **Introduction**
+Investigate certificate issuance and authentication risks in Active Directory Certificate Services, including vulnerable templates and CA trust.
+
+## Background
 
 **Active Directory Certificate Services (AD CS)** is a Microsoft role that enables organisations to build and manage a Public Key Infrastructure (PKI). AD CS is often used to issue and manage certificates for secure communication, authentication, and encryption within a Windows environment. While AD CS is a powerful tool for securing an enterprise, misconfigurations or improper implementation can make it a prime target for attackers.
 

detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-events-for-detecting-compromise.md

@@ -1,5 +1,7 @@
 # Active Directory Events for Detecting Compromise
 
+Use domain controller security events as investigation leads, taking audit policy and event coverage into account.
+
 Recommended event IDs to log and monitor to detect the Active Directory compromises detailed in the  [Detect and Mitigate Active Directory Compromise](./) sections
 
 ### Domain Controller Events

detection-engineering/threat-detection/ad-detections-and-mitigations/active-directory-security-controls.md

@@ -1,6 +1,8 @@
 # Active Directory Security Controls
 
-### **Introduction**
+Review Active Directory security controls and the evidence needed to assess their effectiveness.
+
+## Background
 
 Organisations with effective mitigation controls are better equipped to prevent, detect, and respond to cybersecurity threats. These controls include a mix of preventive measures, such as firewalls, endpoint protection, and intrusion prevention systems, as well as detective mechanisms like security information and event management (SIEM) systems and anomaly detection tools. By layering these defences, organisations create a robust security framework that minimises the likelihood of breaches while maintaining continuous visibility into their network. Regular vulnerability assessments, penetration testing, and timely patch management ensure that known vulnerabilities are promptly addressed, reducing exposure to attacks.
 

detection-engineering/threat-detection/ad-detections-and-mitigations/dumping-ntds.dit.md

@@ -1,6 +1,8 @@
 # Dumping ntds.dit
 
-### **Introduction**
+Examine evidence of Active Directory database access or copying while preserving domain controller forensic evidence.
+
+## Background
 
 The **NTDS.dit** file is the Active Directory (AD) database that stores all directory information, including user account data, group memberships, and most critically, password hashes. Dumping the **NTDS.dit** file is a technique used by attackers to extract this sensitive information and gain unauthorised access to an organisation's domain.
 

detection-engineering/threat-detection/ad-detections-and-mitigations/golden-certificate.md

@@ -1,6 +1,8 @@
 # Golden Certificate
 
-### **Introduction**
+Examine suspected abuse of a compromised certificate authority and the certificates an attacker may have issued.
+
+## Background
 
 A **Golden Certificate** is an advanced attack technique used to compromise Active Directory Certificate Services (AD CS). Similar to the **Golden Ticket** in Kerberos attacks, a Golden Certificate allows an attacker to forge a legitimate certificate that can be used to impersonate any user, escalate privileges, or maintain persistent access within a domain environment. The attack exploits the trust model of the Public Key Infrastructure (PKI) and the inherent design of certificates issued by AD CS.
 

detection-engineering/threat-detection/ad-detections-and-mitigations/golden-security-assertion-markup-language-saml.md

@@ -1,6 +1,8 @@
 # Golden Security Assertion Markup Language (SAML)
 
-### Introduction
+Investigate suspected federation signing-key compromise and potentially forged SAML assertions.
+
+## Background
 
 The **Golden SAML** attack is a sophisticated technique targeting federated identity systems that utilise Security Assertion Markup Language (SAML) for authentication. In this attack, adversaries exploit the trust relationship between identity providers (IdPs) and service providers (SPs) to forge authentication tokens. By compromising the private key of the IdP or gaining administrative access, attackers can create valid SAML assertions, impersonate any user (including administrators), and gain unauthorised access to federated services. This attack is particularly dangerous in cloud environments, such as Office 365, AWS, and GCP, where SAML is commonly used for single sign-on (SSO).
 

detection-engineering/threat-detection/ad-detections-and-mitigations/machineaccountquota-compromise.md

@@ -1,6 +1,8 @@
 # MachineAccountQuota Compromise
 
-### **Introduction**
+Review the risks of computer-account creation rights and suspicious machine account activity.
+
+## Background
 
 **MachineAccountQuota** is an attribute in Active Directory that specifies how many machine accounts a user can create in the domain. By default, this value is set to **10**, meaning any authenticated domain user can create up to 10 machine accounts without administrative privileges. While this setting supports certain use cases, it also introduces a security risk if exploited by attackers.
 

detection-engineering/threat-detection/ad-detections-and-mitigations/microsoft-entra-connect-compromise.md

@@ -1,6 +1,8 @@
 # Microsoft Entra Connect Compromise
 
-### **Introduction**
+Investigate suspicious changes and access involving Microsoft Entra Connect and hybrid identity synchronization.
+
+## Background
 
 Microsoft Entra Connect (formerly Azure AD Connect) is a critical tool for synchronising on-premises Active Directory (AD) with Azure Active Directory (Azure AD). It allows organisations to manage identities across hybrid environments seamlessly. A **Microsoft Entra Connect Compromise** occurs when attackers exploit misconfigurations, vulnerabilities, or compromised credentials related to the Entra Connect server or its components. Such compromises can enable adversaries to manipulate identity synchronisation, escalate privileges, or exfiltrate sensitive data.
 

detection-engineering/threat-detection/ad-detections-and-mitigations/one-way-domain-trust-bypass.md

@@ -1,6 +1,8 @@
 # One-way Domain Trust Bypass
 
-### **Introduction**
+Review cross-domain trust boundaries, permitted authentication and unexpected access across a one-way trust.
+
+## Background
 
 In multi-domain Active Directory (AD) environments, **one-way domain trust** is a mechanism that allows users in one domain (the trusted domain) to access resources in another domain (the trusting domain). This trust relationship is often used to facilitate resource sharing while maintaining administrative separation between domains. However, this setup can be exploited by attackers through a **one-way domain trust bypass**, enabling unauthorised access to resources in the trusting domain. This occurs when attackers abuse the trust relationship to escalate privileges, perform lateral movement, or access sensitive data.
 

detection-engineering/threat-detection/ad-detections-and-mitigations/password-in-group-policy-preferences-gpp-compromise.md

@@ -1,6 +1,8 @@
 # Password in Group Policy Preferences (GPP) Compromise
 
-### **Introduction**
+Identify legacy Group Policy Preferences credentials and assess potential exposure.
+
+## Background
 
 **Group Policy Preferences (GPP)** is a feature in Microsoft Active Directory that allows administrators to configure and deploy system settings, including mapped drives, scheduled tasks, and local user accounts, across domain-joined computers. GPP once supported the deployment of local accounts with embedded passwords stored in the policy files. However, these passwords were encrypted using a weak AES key that was published publicly by Microsoft.
 

detection-engineering/threat-detection/ad-detections-and-mitigations/security-identifier-sid-history-compromise.md

@@ -1,6 +1,8 @@
 # Security Identifier (SID) History Compromise
 
-### **Introduction**
+Investigate changes to SIDHistory and evidence of privilege misuse across trusted domains.
+
+## Background
 
 In Microsoft Active Directory (AD), the **Security Identifier (SID) History** attribute is used to maintain a record of SIDs from previous domains when objects like users or groups are migrated. This allows users to retain access to resources in the original domain without requiring reconfiguration. While SID History is essential for seamless domain migrations and consolidations, it can be exploited in a **SID History Compromise** attack.
 

detection-engineering/threat-detection/ad-detections-and-mitigations/skeleton-key.md

@@ -1,6 +1,8 @@
 # Skeleton Key
 
-### **Introduction**
+Investigate suspicious domain controller authentication behaviour consistent with possible authentication-package tampering.
+
+## Background
 
 The **Skeleton Key** attack is an advanced persistence technique targeting Microsoft Active Directory (AD) environments. It involves injecting a malicious patch into the Local Security Authority Subsystem Service (LSASS) process on a domain controller, allowing attackers to bypass authentication mechanisms. This creates a "skeleton key" password that works for any user account without altering existing credentials or logs. The attack is particularly dangerous because it enables covert and persistent access to all accounts within the domain.
 

detection-engineering/threat-detection/ad-detections-and-mitigations/unconstrained-delegation.md

@@ -1,6 +1,8 @@
 # Unconstrained Delegation
 
-### **Introduction**
+Review unconstrained Kerberos delegation exposure and investigate possible credential misuse on delegated hosts.
+
+## Background
 
 **Unconstrained delegation** is a feature in Microsoft Active Directory (AD) that allows a server or service to impersonate any user who authenticates to it. This is done by granting the server access to the user's Kerberos **Ticket-Granting Tickets (TGTs)**, which are stored in memory. While designed to support scenarios where a service needs to act on behalf of a user across multiple resources, unconstrained delegation introduces significant security risks if misconfigured or exploited by attackers.