Global cybersecurity agencies led by the Australian Cyber Security Centre, CISA, and the NSA published joint guidance on Tuesday detailing strategies to detect and mitigate the 17 most common Active Directory compromise techniques used by malicious actors to escalate privileges and gain full domain control.
How Attackers Enumerate and Exploit Active Directory
When adversaries gain initial access to a network, they systematically enumerate Active Directory to understand the organization’s structure, objects, configurations, and relationships. This intelligence-gathering phase often yields a map of the environment that exceeds the organization’s own internal visibility. Armed with this knowledge, attackers exploit weaknesses to escalate privileges, move laterally across systems, and achieve full domain control.
Active Directory stores data as objects representing resources such as users, computers, groups, and organizational units. The most common objects are user and computer objects, which the directory uses for authentication, authorization, and policy enforcement. Malicious actors specifically target the highest-privileged accounts, particularly Domain Admins and Enterprise Admins, to seize control of the entire domain.
To map and assess these environments, organizations utilize commercial and open-source assessment tools. These include BloodHound for graphical representations of misconfigurations, PingCastle for security reporting, and Purple Knight for assessing security postures in Active Directory environments.
Multi-Agency Collaboration and the Enterprise Access Model
The guidance was developed through an international partnership involving the Australian Cyber Security Centre (ACSC), the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Canadian Centre for Cyber Security (CCCS), the U.K. National Security Centre (NCSC-UK), and the New Zealand National Security Centre (NCSC-NZ). These agencies cover core security functions including threat identification, threat dissemination, and the creation of security specifications.
To counter these threats, the agencies point to Microsoft’s Enterprise Access Model as a necessary framework for modern hybrid environments where on-premises Active Directory connects to cloud services via Entra ID. The model enforces strict hierarchies. Tier 0 highly privileged accounts must never expose their credentials to lower tiers, and Tier 0 computers are managed exclusively by Tier 0 users.
Additional protections for Tier 0 assets include phishing-resistant multi-factor authentication, privileged access workstations, Kerberos armoring, and zero-trust policies. Implementing these controls makes common attacks significantly harder to execute, forcing attackers toward riskier techniques that increase the likelihood of early detection.
Kerberoasting Mechanics and Detection Challenges
Among the techniques detailed in the multi-agency guidance is kerberoasting, which exploits user objects configured with service principal names. Attackers request Ticket Granting Service tickets from the Domain Controller—a routine function in Active Directory—and then crack the encrypted ticket offline to recover the cleartext password.
Because kerberoasting mimics legitimate ticket requests, it remains difficult for defenders to detect. If the targeted service account holds elevated privileges, such as membership in the Domain Admins group, the successful compromise of a single password can result in total domain takeover.
Proactive Critical Infrastructure Hunts and Baseline Findings
While global agencies focused on Active Directory hygiene, domestic hunt operations revealed persistent operational risks. CISA and the U.S. Coast Guard conducted a proactive threat hunt at a U.S. critical infrastructure organization to determine if malicious actors were present on the network following an invitation from the organization.
Although the hunt team did not find evidence of malicious actor presence, they identified significant cybersecurity risks that threaten critical infrastructure. These vulnerabilities included insufficient logging, insecurely stored credentials, shared local administrator credentials across multiple workstations, unrestricted remote access, and inadequate network segmentation between information technology and operational technology assets.
Exchange Server Risks and Emergency WSUS Patching
Compounding these infrastructure risks, organizations running on-premises infrastructure face severe pressures regarding legacy software. Four major cybersecurity agencies issued comprehensive security guidance for Microsoft Exchange Server hardening, highlighting that Microsoft ended support for previous Exchange versions on October 14, leaving unsupported environments exposed to continuous targeting according to the reporting.
Concurrently, IT teams scrambled to address a critical Windows Server Update Service vulnerability tracked as CVE-2025-59287. Initial patches failed completely, forcing an emergency out-of-band update after active exploitation attempts struck multiple organizations. Google’s Threat Intelligence Group and Eye Security investigated these campaigns, which saw attackers breach systems and exfiltrate sensitive data before activity tapered.