Cybersecurity experts from CISA, five international agencies, and the Australian Signals Directorate have released a detailed guide outlining 17 common methods hackers use to infiltrate Microsoft Active Directory environments. The technical document explains how attackers exploit identity configurations, legacy protocols, certificate services, and privileged systems to escalate access, move laterally, and establish long-term persistence within enterprise networks. Developed by the Australian Cyber Security Center in collaboration with CISA, NSA, and the National Cyber Security Center of Canada, UK, and New Zealand, the guidance also includes contributions from the National Cyber Security Center of Australia and the National Cyber Security Center of New Zealand.
- 11. 12.
Organizations should isolate privileged administration, deploy phishing-resistant multifactor authentication, use secure administrative workstations, minimize delegated permissions, remove unnecessary service principal names, and replace conventional service accounts with Group Managed Service Accounts wherever possible. Administrators should also enforce Kerberos pre-authentication and AES encryption, set MS-DS-MachineAccountQuota to zero, eliminate unconstrained delegation, remove legacy Group Policy passwords, disable NTLM and SMBv1 where feasible, and protect LSASS. The guidelines mention events like 4768 and 4769 for unusual Kerberos activity, 4662 and 5712 for directory replication issues, 4741 for unexpected computer-account creation, 4886 and 4887 for certificate requests, and 5136 for suspicious directory-object changes.
Explore 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
