Cybersecurity
Active Directory security
Active Directory is still the identity backbone for most enterprises, and still the most common route to total compromise. We map the paths an attacker could follow to domain control and show how to cut them.
The problem this service solves
An AD environment accumulates decades of choices: permissions delegated for a project that ended, service accounts with weak passwords that never rotate, certificate templates that allow impersonation, administrators who log in to workstations. Attackers do not need a single exploit. They chain these.
The central question is how many steps separate an ordinary user from Domain Admin. We compute it, validate the steps by hand and show the cheapest way to break the paths.
What is in scope
-
Privileged groups and tiering
Membership, nested groups, administrator logon patterns and separation of tiers.
-
Delegation and ACLs
Unconstrained and constrained delegation, resource-based delegation and dangerous object permissions.
-
Kerberos and NTLM
Kerberoastable and AS-REP roastable accounts, NTLM relay opportunities, SMB and LDAP signing.
-
Active Directory Certificate Services
Template misconfiguration, enrollment permissions and CA settings.
-
Credentials
Passwords in Group Policy Preferences, SYSVOL scripts, shared local administrator passwords and LAPS coverage.
-
Trusts and hybrid
Forest trusts, Entra Connect or cloud sync, and on-premises to cloud privilege paths.
-
Detection
Whether common AD attacks are logged and alerted.
How the work runs
Collect
Gather AD data.
-
1
Data collection
Run collectors with standard domain user rights for attack path analysis, and read-only audit queries.
Analyze
Find and verify paths.
-
2
Graph analysis
Compute shortest paths to privileged objects.
-
3
Validation
Verify selected paths manually in a controlled way.
-
4
Configuration review
Check protocol settings, templates and GPOs.
Improve
Cut paths.
-
5
Prioritized fixes
Choose changes that break many paths at once.
-
6
Detection recommendations
Event IDs and queries for common AD attacks.
What you receive
- Executive summary
- Attack path graphs to privileged objects
- Findings with remediation steps
- Tiering and administrative model recommendations
- AD CS review
- Detection recommendations
- Retest
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- A standard domain user account
- Read-only audit access for configuration review
- Description of trust relationships and hybrid identity
What this service is not
- A full migration project
- Direct changes to production AD
What changes afterwards
- The number of paths to Domain Admin drops
- Privileged accounts are separated from daily use
- AD attacks produce alerts
Questions people ask
Do you need domain admin rights?
No. We start with ordinary domain user permissions, which reflects what an attacker would have after a phishing compromise.
Is BloodHound safe to run?
Collection generates normal LDAP and SMB queries and is generally low-impact. We schedule it and tell your SOC so alerts are expected.
Why do you check Active Directory Certificate Services?
Misconfigured templates can let a low-privilege user obtain a certificate as a privileged account. It is one of the most impactful and least reviewed areas.
Related
-
Microsoft Entra security
Review Conditional Access, privileged roles, application consent, authentication methods, sync and monitoring in Microsoft Entra ID.
-
Privileged access management
Design and implement controls for administrator, service and cloud privileged accounts: vaulting, just-in-time access and session control.
-
Ransomware readiness
Assess whether you could detect, contain and recover from ransomware, and fix the weak points: identity, backups, segmentation and response.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response