38. Active Directory Attacks and Defence
38.1 AD Basics for Defenders
Active Directory Domain Services – central authentication (प्रमाणीकरण) ani authorization for Windows. Domain = management boundary (example: sahyadri.lab). Forest = one or more domains that trust each other. Domain Controller (DC) = server that holds the directory database (NTDS) and answers Kerberos / LDAP.
Kerberos (default in domain): ticket-based. User proves password once to DC → gets TGT (Ticket Granting Ticket) → asks for service tickets (TGS) for file servers, SQL, HTTP SPNs. NTLM: older challenge-response; still appears for legacy / misconfig / local logons – attackers love it for relay.
LDAP role: query/modify directory objects (users, groups, computers, ACLs). Port 389 / LDAPS 636 – Chapter 37 madhe anonymous bind risk baghitla; AD madhe authenticated LDAP = BloodHound data source.
Why AD matters: ek Domain Admin compromise = almost full enterprise. Blue team job = reduce paths to DA, detect ticket abuse, harden legacy protocols. Samjla ka?
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Maps domain users/groups via LDAP after any foothold | Monitor LDAP volume spikes; require LDAPS; disable anonymous bind; alert on unusual bind accounts |
| Prefers Kerberos ticket theft / abuse over noisy password spray | Enable advanced audit (Kerberos TGT/TGS); watch Event ID 4768/4769 anomalies; MFA for admins |
| Looks for NTLM fallback hosts | Prefer Kerberos; disable NTLM where possible; SMB/LDAP signing |
Ravindra Bagale's Tip
Students confuse "Domain Admin" with a local "Administrator". A local Admin controls one machine; a Domain Admin = almost all domain-joined machines + DC rights. In interviews, explain Tier-0 (DC/identity) vs Tier-1 (servers) vs Tier-2 (workstations) – the idea behind Microsoft's Enterprise Access Model. Remember this.
Ravindra Bagale's Tip – मराठी
Students "Domain Admin = local Administrator" असा गोंधळ करतात. Local Admin एक machine; Domain Admin = जवळजवळ सगळ्या domain joined machines + DC rights. Interview मध्ये Tier-0 (DC/identity) vs Tier-1 (servers) vs Tier-2 (workstations) सांगा – Microsoft Enterprise Access Model ची idea. हे लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
Students "Domain Admin = local Administrator" ऐसा उलझ जाते हैं. Local Admin एक machine; Domain Admin = लगभग सारी domain joined machines + DC rights. Interview में Tier-0 (DC/identity) vs Tier-1 (servers) vs Tier-2 (workstations) बताओ – Microsoft Enterprise Access Model का idea. यह याद रखो.
Lab
Notes madhe ek table banava: Domain / Forest / DC / TGT / TGS / NTLM – ek-ek line definition (swatahchya shabdat). Fictional org: Sahyadri Traders, Pune, domain sahyadri.lab. Shraddha Bagale (helpdesk) vs Raja (Domain Admin) – kontya Tier madhe? 5 sentences liha.
Real incident: SolarWinds Orion supply-chain (2020)
Public reporting (CISA / FireEye Mandiant) described attackers abusing a trusted software update path, then moving toward identity systems and privileged access in victim environments. Weakness theme: trust in software + privileged identity. Defence mindset: least privilege, Tier isolation, monitor unusual directory / IdP activity, patch supply-chain monitoring. Source: CISA alerts and Mandiant public reports on SUNBURST / related activity (verify URLs).