Active Directory Basics

What Active Directory Is and Why It Is the Prime Target

• Active Directory (AD) is Microsoft’s directory service for Windows domain networks.
• It stores information about every object in the domain — users, computers, groups, printers, shared folders, and services — and enforces security policies across all domain-joined systems.
• AD was introduced in Windows 2000 Server and is the identity backbone of over 90% of Fortune 500 organizations.
• For an attacker, AD is the ultimate prize: compromise the domain controller, and you own everything.

Core AD Components Every Analyst Must Know

Domains and Forests

• A domain is the core administrative unit. It defines a security boundary: domain administrators in one domain do not automatically have authority over another domain.
• A forest is a collection of domains that share a common schema, global catalog, and transitive trust between every domain in the forest.
• The forest root domain is the first domain created and holds the Enterprise Admins and Schema Admins groups — the highest privilege groups in AD.
• In a multi-domain forest, attackers who compromise the forest root can compromise every domain.

Detection implications: When you see authentication traffic crossing domain boundaries or between forests (Event ID 4624 with a security ID from another domain), check whether it is authorized cross-forest trust traffic or lateral movement. BloodHound shows trust path analysis — expect attackers to abuse it.

Organizational Units (OUs)

• OUs are containers within a domain used to organize objects (users, computers, groups) and delegate administrative control.
• OUs are not a security boundary — they are an administrative boundary. Group Policy applies per OU; delegated permissions apply per OU.
• Attackers target OUs containing high-value objects: servers, service accounts, executives.

Detection implications: Event ID 5136 (directory service change) on an OU delegate permission change is a high-signal event. An attacker adding themselves to the “Server Operators” OU delegation is privilege escalation (MITRE T1098).

Trust Relationships

• Trusts allow users in one domain to authenticate to resources in another domain.
• Trust types: Parent-child (automatic, transitive), Forest (manual, transitive), External (manual, non-transitive, one-way or two-way), Realm (with non-Windows Kerberos realms).
• A trust is one-way by default: Domain A trusts Domain B means Domain B’s users can access Domain A’s resources, but not vice versa.
• Attackers enumerate trusts to find cross-domain or cross-forest lateral movement paths. Tools like BloodHound map every trust and every path between them.

Detection implications: Event ID 4624 with a logon type 3 (network) from a user in a different domain or forest is normal only if there is a legitimate cross-domain resource access. A user from corp.local authenticating to admin.corp.local’s domain controller is lateral movement.

Security Principals and Group Types

• A security principal is any entity that can be authenticated: user, computer, group, or service account.

• Group scopes:

  • Domain Local — grants access to resources within the local domain. Can contain members from any domain in the forest.
  • Global — groups users with similar roles. Can be placed into Domain Local groups in any domain in the forest.
  • Universal — members from any domain in the forest. Used for cross-domain permissions.

• Built-in sensitive groups (the ones attackers target):

Kerberos Authentication Flow

1. User logs in → workstation sends an AS-REQ to the Domain Controller (DC)
2. DC checks the password and responds with a TGT (Ticket Granting Ticket) encrypted with the user’s password hash
3. User wants to access a resource (e.g., a file server) → workstation sends a TGS-REQ to the DC with the TGT
4. DC validates the TGT and sends a TGS (Ticket Granting Service) ticket encrypted with the target service account’s NTLM hash
5. Workstation presents the TGS to the file server → server decrypts it with its own NTLM hash and grants access

Detection implications: Step 4 is the foundation of Kerberoasting (T1558.003) — any domain user can request a TGS for any service account. Event IDs 4768 (TGT requested) and 4769 (TGS requested) are volume-high but need filtering: a single user requesting TGS tickets for many different SPNs in a short window is suspicious.

Detection — Investigating AD Compromise

Key Event IDs to Monitor

SPL query — detect group membership change to sensitive groups:

index=windows sourcetype=WinEventLog:Security
(EventCode=4728 OR EventCode=4732 OR EventCode=4746 OR EventCode=4756)
| search TargetUserName="Domain Admins" OR TargetUserName="Enterprise Admins" OR TargetUserName="Administrators"
| stats values(SubjectUserName) as ChangedBy, values(TargetUserName) as TargetGroup by _time, MemberName
| eval alert = if(match(MemberName, "(?i)(temp|test|backup|admin[0-9])"), "CRITICAL — Suspicious member added to privileged group", "HIGH — Member added to privileged group")
| table _time, ChangedBy, MemberName, TargetGroup, alert

SPL query — detect Kerberoasting (many TGS requests from one source):

index=windows sourcetype=WinEventLog:Security EventCode=4769
| stats dc(TargetUserName) as UniqueServiceAccounts by ClientAddress, AccountName
| where UniqueServiceAccounts > 10
| eval alert = "HIGH — Possible Kerberoasting: " . AccountName . " requested " . UniqueServiceAccounts . " TGS tickets from " . ClientAddress

Common AD Attack Vectors and Detection

Related

• Common Ports and Protocols — covers the common ports and protocols concepts
• Log Sources Overview — covers the log sources overview concepts
• Active Directory Compromise Response — detection and response for T1558 techniques
• Cloud Threats — Credential Theft, IMDS Abuse, Hijacking, Privilege Escalation — detection and response for T1525, T1552, T1613 techniques
• Golden Ticket Attack — detection and response for T1558.001 techniques

Sources

• Microsoft Active Directory Documentation
• Microsoft Advanced Security Audit Policy
• BloodHound
• MITRE ATT&CK — Enterprise Matrix
• Microsoft — Monitoring AD for Signs of Compromise