Active Directory remains the heart of most enterprise authentication — and the highest-value target on any internal compromise. Modern AD attacks rarely use exploits; they abuse legitimate Kerberos and replication protocols (Kerberoasting, AS-REP Roasting, DCSync, Golden/Silver Tickets, Pass-the-Hash/Ticket) to escalate from a normal user to Domain Admin in hours.
Detection must combine Windows Security Event Logs (4769, 4662, 4624), Microsoft Defender for Identity (formerly Azure ATP), and EDR process telemetry. Speed matters: once an attacker has KRBTGT or a domain admin hash, the only true remediation is a full forest password reset and KRBTGT double-reset — which is hours of operational pain. Catching it in the SPN enumeration / DCSync phase keeps recovery cheap.
◈ Table of Contents
01
Background
CONTEXTB1Attack Techniques & MITRE Mapping
| Attack | MITRE | Key Indicator | Severity |
|---|---|---|---|
| Kerberoasting | T1558.003 | 4769 TGS-REQ with encryption type 0x17 (RC4-HMAC) to many SPNs from one host | HIGH |
| AS-REP Roasting | T1558.004 | 4768 AS-REQ for accounts with DONT_REQUIRE_PREAUTH (UAC 0x400000) | HIGH |
| DCSync | T1003.006 | 4662 with Replicating-Directory-Changes-All extended right from non-DC computer account | CRITICAL |
| DCShadow | T1207 | Unauthorized computer registering as DC; 5137/5141 directory service object creation/deletion | CRITICAL |
| Golden Ticket (forged TGT) | T1558.001 | 4624 logons with no prior 4768; TGT lifetime > domain policy default; mimikatz signatures | CRITICAL |
| Silver Ticket (forged TGS) | T1558.002 | Service access (4624 type 3) with no prior 4769 TGS-REP on DC; suspicious PAC signatures | CRITICAL |
| Pass-the-Hash / Pass-the-Ticket | T1550.002 / T1550.003 | 4624 type 9 (NewCredentials) from non-admin to admin; mimikatz sekurlsa / lsadump | HIGH |
B2Log Sources & Tools
| Source | Table / Portal | Key Events |
|---|---|---|
| Windows Security Event Log (DCs) | SecurityEvent / WEF | 4768, 4769, 4624, 4625, 4662, 4672, 4738 |
| Defender for Identity (MDI) | IdentityLogonEvents, IdentityDirectoryEvents | Suspected DCSync, Kerberoasting, Golden Ticket, lateral movement paths |
| EDR (Defender for Endpoint / equivalent) | DeviceProcessEvents, DeviceLogonEvents | mimikatz / Rubeus / Impacket process signatures; LSASS access |
| Sysmon | Sysmon EID 10, 11, 1 | Process access to lsass.exe; SAM/SECURITY hive copies; suspicious child of services.exe |
02
Identification
INVESTIGATEAD Attack — Investigation Workflow
I1Kerberoasting DetectionKQL + SPL
KQL — Sentinel: Burst of RC4 TGS-REQ from single source
// Kerberoasting hallmark: many 4769 events with TicketEncryptionType 0x17 (RC4) from one host in a short window
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4769
| where TicketEncryptionType == "0x17"
| where TargetUserName !endswith "$" // exclude machine accounts
| summarize SPNs=dcount(ServiceName), TotalReqs=count(), SampleSPNs=make_set(ServiceName, 10)
by Account = TargetUserName, IpAddress, bin(TimeGenerated, 30m)
| where SPNs >= 5 and TotalReqs >= 10
| order by TimeGenerated desc
SPL — Splunk equivalent
index=wineventlog EventCode=4769 Ticket_Encryption_Type=0x17 NOT Account_Name="*$"
| bin _time span=30m
| stats dc(Service_Name) as spn_count count as req_count values(Service_Name) as spns by Account_Name, Client_Address, _time
| where spn_count >= 5 AND req_count >= 10
Defender for Identity raises this as Suspected Kerberoasting (External ID 2410). If you have MDI, the alert + lateral movement path graph is faster than raw 4769 hunting — but always validate against raw events to scope the source host and timeframe.
I2DCSync Detection (Critical)KQL
KQL — Replicating-Directory-Changes-All from non-DC
// 4662 with the DS-Replication-Get-Changes-All GUID (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2) from a host that is NOT a DC
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4662
| where Properties has "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
or Properties has "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
or Properties has "89e95b76-444d-4c62-991a-0facbeda640c"
| where AccessMask has "0x100"
| join kind=leftanti (
DeviceInfo | where DeviceType == "DomainController" | distinct ComputerName=DeviceName
) on $left.SubjectUserName == $right.ComputerName
| project TimeGenerated, Computer, SubjectAccount=SubjectUserName, SubjectDomainName, ObjectName, IpAddress
| order by TimeGenerated desc
Any 4662 with Replicating-Directory-Changes-All from a non-DC host should be treated as confirmed DCSync until proven otherwise — there is essentially no legitimate reason for a workstation or member server to invoke this right.
I3Golden / Silver Ticket & AS-REP Roast DetectionKQL
KQL — Logon without prior TGT issuance (Golden Ticket suspect)
// Successful logon (4624) where the same account has no corresponding 4768 in the last 24h on any DC
let logons = SecurityEvent
| where TimeGenerated > ago(7d) | where EventID == 4624 and LogonType in (3, 10)
| project TimeGenerated, Account=TargetUserName, IpAddress;
let tgts = SecurityEvent
| where TimeGenerated > ago(7d) | where EventID == 4768
| project TgtTime=TimeGenerated, Account=TargetUserName;
logons
| join kind=leftouter tgts on Account
| where TgtTime < TimeGenerated and TgtTime > ago(1d)
| where isempty(TgtTime)
| project TimeGenerated, Account, IpAddress
KQL — AS-REP Roastable accounts being queried
// AS-REQ (4768) where pre-auth was not required — encrypted blob can be cracked offline
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4768
| where PreAuthType == "0"
| where TargetUserName !endswith "$"
| summarize Count=count(), Sources=make_set(IpAddress, 10) by TargetUserName
| order by Count desc
Hunt for DONT_REQUIRE_PREAUTH accounts proactively: Get-ADUser -Filter 'useraccountcontrol -band 4194304' -Properties useraccountcontrol. Either fix the flag or accept they will be roasted — and monitor 4768 PreAuthType=0 events accordingly.
I4FP vs TP Decision Gate
| True-Positive Signals | False-Positive Signals |
|---|---|
| Many TGS-REQ for diverse SPNs from a workstation in minutes | Service host that legitimately consumes many services (e.g. vCenter, monitoring agent) |
| 4662 replication right from member server / workstation | 4662 from a legitimate DC, AAD Connect server, or Azure AD Sync account |
| Logons appearing without a corresponding 4768 anywhere in the forest | Service account using S4U2Self / S4U2Proxy (constrained delegation) |
| mimikatz / Rubeus / Impacket SHA-256 detected on EDR | Authorized red team window with prior change-record approval |
03
Containment
STOP ITC1Source Host & Account ContainmentImmediate
- 1Isolate source host: Defender for Endpoint → Devices → [host] → Isolate device. Live Response — capture memory and lsass.exe before reboot if possible.
- 2Disable suspect account(s): AD Users and Computers → [user] → Disable Account. Move to a quarantine OU with no GPOs.
- 3Revoke Kerberos tickets:
klist purgeon affected endpoints; for the user, reset password (this auto-invalidates TGTs after re-auth). - 4Reset compromised service account passwords: any account whose SPN was Kerberoasted needs immediate password reset to a high-entropy value (≥30 chars). Coordinate with service owner — restart of services often required.
C2If DCSync / KRBTGT Compromise Suspected
- 1Treat as enterprise-wide event. A successful DCSync means the attacker has every hash including KRBTGT. Any session ticket they have lives until forced expiry.
- 2Plan a coordinated double KRBTGT reset:
Reset-KrbTgtKeyInteractive.ps1(Microsoft script) executed twice, with at least the maximum ticket lifetime (default 10h) between resets, across all domains in the forest. - 3Reset all privileged accounts: Tier 0 (DAs, EAs, Schema Admins, KRBTGT, AAD Connect MSOL_) — passwords AND smart-card certs.
- 4Block attacker IPs/ASNs at perimeter and quarantine any host that performed unusual replication.
A single KRBTGT reset is not enough — Kerberos clients keep the prior key as a fallback. You MUST do two resets, separated by >10 hours (default Max-Ticket-Lifetime), or attacker's Golden Tickets remain valid.
04
Eradication
CLEAN UPE1Full AD Cleanup
- 1Audit Tier 0 group membership (Domain Admins, Enterprise Admins, Schema Admins, Backup Operators, Account Operators) — remove anything added during the incident window.
- 2Search for backdoor persistence: AdminSDHolder ACL changes, SeDebugPrivilege grants on member servers, hidden service accounts with SPN, scheduled tasks running as SYSTEM created during the incident.
- 3Remove any unauthorized Kerberos delegation (especially unconstrained / RBCD) added during the incident.
- 4Force re-authentication of all privileged users; verify smart-card-only enforcement on Tier 0 accounts.
- 5Re-run identification KQL queries with the incident window — expected result: zero matches.
Eradication Complete When
- Source host(s) rebuilt from gold image, not just re-isolated
- All Tier 0 passwords reset; KRBTGT double-reset completed if DCSync occurred
- AD ACL / delegation review complete; backdoor SPNs removed
- EDR + MDI clean across all DCs and member servers for 48 hours
- Privileged Access Workstation (PAW) policy enforced for remaining Tier 0 access
05
Escalation
TIERSESC1Escalation Tiers
| Tier | Trigger | Action / Handoff Bundle |
|---|---|---|
| L1 → L2 | Kerberoasting / AS-REP roast suspected, no Tier 0 account involved | Source host, target SPNs, request volume, EDR process list |
| L2 → IR Team | Confirmed DCSync, suspected Golden/Silver Ticket, Tier 0 account compromised | Memory image, MDI alert chain, full Tier 0 audit, replication log proof |
| IR → CISO + Legal | KRBTGT compromise confirmed, OR forest-wide breach, OR Tier 0 accessed customer-facing systems | Forest reset plan, business continuity comms, regulator pre-notification |
| External | Active in-progress attack and internal capability insufficient; ransomware indicators | Microsoft DART / qualified IR vendor; law enforcement (FBI IC3 / equivalent) |
Authorized security research & penetration testing only. Unauthorized use is illegal. Authored by Rudra Verma | Senior Security Architect | CyberHawk Threat Intel.