Active Directory: The 8 Most Common Attack Paths

Once an attacker is inside the network, their first objective is not data theft but domain administrator rights. Everything else follows from there: deleting backups, lateral movement, mass encryption. Active Directory is therefore not one system among many but the turning point of the attack.

This article covers the paths that lead there, and what can be done about each.

1. Kerberoasting

What the attacker does. Any domain user can request a service ticket (TGS) for an account with an SPN. The ticket is encrypted with the service account's password hash, so it can be cracked offline. No elevated rights are needed, and the request itself looks like normal operation.

Why it works. Service account passwords are often short, dictionary-based, and unchanged for years.

What to do:

• Give SPN-bearing accounts a random password of at least 25 characters. At that length offline cracking is effectively hopeless.
• Where possible use gMSA (group Managed Service Account): AD manages and rotates the password automatically.
• Review which accounts carry an SPN unnecessarily, and never give one to a domain admin account.
• Alert on: unusually many TGS requests from a single account, particularly with RC4 encryption.

2. AS-REP roasting

What the attacker does. If Kerberos pre-authentication is disabled on an account, anyone can request an AS-REP response for it, which is also crackable offline. This does not even require authenticated access.

What to do. Simple: find accounts with the DONT_REQ_PREAUTH flag and re-enable pre-authentication. Typically this is a handful of legacy accounts and takes minutes. Where it genuinely cannot be re-enabled, a long random password is the answer.

3. Password spraying

What the attacker does. Rather than trying many passwords against one account (which triggers lockout), they try one or two common passwords against many accounts. Patterns like Spring2026! or company name plus year succeed surprisingly often.

What to do:

• Banned password list: company name, product names, seasons and locally common passwords. Length requirements alone do not defend against this.
• MFA on every externally reachable service. This attack starts at the perimeter, typically on webmail or VPN.
• Alert on: failed sign-ins across many accounts in a short window from a single source IP.
• Disable legacy authentication protocols, because MFA does not protect them.

4. ACL and privilege abuse

What the attacker does. AD's permission structure becomes opaque over years. An attacker looks not for a vulnerability but for a privilege chain: which account can write to a group that belongs to another group holding password reset rights over an admin.

This chain can be mapped in minutes with a graph tool (BloodHound), and such a path exists in most domains.

What to do:

• Map it yourself. With the same tool an attacker would use. This is the fastest way to find unintended paths.
• Tiered admin model: domain admin accounts sign in only to domain controllers, never to workstations.
• Regular access reviews, particularly of nested group memberships.
• Examine AdminSDHolder and protected group membership.

5. Credentials in memory

What the attacker does. With administrative rights on a machine they can read signed-in users' tickets and hashes from memory. If a domain admin ever signed in to that machine, the attacker inherits their rights.

What to do:

• Enable Credential Guard on supported systems.
• Tiered model: never sign in with an admin account to a workstation or general member server.
• LAPS: a unique, automatically rotated local admin password on every machine. Without it, one shared local password means access to the entire estate.
• RDP Restricted Admin mode, so remote sign-in leaves no credentials on the target.

6. Delegation misconfiguration

What the attacker does. Kerberos delegation lets a service act on a user's behalf. With unconstrained delegation the service receives the user's full ticket, so it can impersonate anyone who connects to it.

What to do. Find machines and accounts configured for unconstrained delegation and move them to constrained or resource-based delegation. Outside domain controllers, unconstrained delegation has no place. This is typically a handful of legacy systems, and finding them is a single query.

7. Certificate Services (ADCS) template flaws

What the attacker does. If a certificate template lets the requester supply the subject (SAN), anyone can request a certificate identifying a domain administrator. That certificate then authenticates them as admin, without a password.

What to do. Review certificate templates: which permit arbitrary SANs, which lack an approval requirement, and which grant enrolment rights too broadly. This attack class is relatively recent, so many environments have never reviewed it at all.

8. Legacy protocols

What the attacker does. NTLMv1, SMBv1 and LLMNR/NBT-NS name resolution all leak or relay credentials. A device placed on the network passively harvests hashes whenever machines perform name resolution.

What to do:

• Disable LLMNR and NBT-NS via group policy. A few clicks, and it eliminates passive hash harvesting.
• Enforce SMB signing so relaying does not work.
• Disable NTLMv1 and LM, and restrict NTLM use where possible.

Where to start

If you do one thing, start with discovery: run an AD assessment using the same tools an attacker would. The result is typically a handful of concrete, fixable paths rather than hundreds of theoretical flaws.

After that, this order works:

1. Quick fixes: disable LLMNR, fix AS-REP roastable accounts, remove unconstrained delegation. A matter of days.
2. Passwords: long passwords or gMSA for service accounts, LAPS rollout, banned password list.
3. Tiered admin model: the largest piece of work, but the most durable protection.
4. Monitoring: every attack above leaves traces, provided logs are collected and somebody watches them.

We covered that fourth point in our SIEM deployment article, and strengthening authentication in MFA types. If you want to assess where you stand, our IT security services include AD assessment.