This week, we briefed our clients on a CISA/NSA document, "Detecting and Mitigating Active Directory Compromises." Be sure to implement these AD controls.
KEY TAKEAWAYS
Joint publication from CISA/NSA/ASD details most of the known attack techniques for Active Directory, as well as how to detect and mitigate these techniques.
Critical and high severity vulnerabilities Microsoft, Cisco, Check Point, and SolarWinds, plus updates to CISA KEV, patch now!
Last week, The Australian Signals Directorate, along with CISA, the NSA, and other international cybersecurity organizations, published a document titled "Detecting and mitigating Active Directory compromises." This document outlines a long list of common and not-so-common attacks on Active Directory (AD), and more importantly, how to detect and mitigate these attacks. It is a rare thing to have this level of detail on so many attacks all documented in one place. This article will highlight some of the attacks mentioned in this document. However, it is strongly encouraged that network security teams and IT administrators review this document thoroughly and implement as many of the recommended controls as possible. While every environment is unique, and not every control can be implemented universally, taking these proactive measures will ensure that threat actors have a much harder time achieving their goals, giving security teams extra time to detect and prevent further intrusions.
The "Why" of AD Security
The document provides such a great summary of why AD security is so important, it is best to quote it in its entirety: "The immediate objective of malicious activity involving Active Directory is to escalate privileges and gain control of a domain by targeting the highest privileged user objects, such as those in the Domain Admins and Enterprise Admins security groups. Although significant access can often be obtained by targeting other user objects, such as service accounts, preventing malicious actors from acquiring the highest privileges is crucial for limiting their overall access. Therefore, securing privileged access is essential for mitigating Active Directory compromises and should be a top priority for all organizations."
Securing AD means making it as difficult as possible for threat actors to elevate privileges and gain control of the domain.
The AD Attack Methods
The following is a list of all of the attack methods that are discussed in detail in the document. While some of these are more common than others, they all represent different methods and techniques threat actors can employ to escalate privileges and gain control of a domain. Steps should be taken to ensure these are prevented or made as difficult as possible.
Kerberoasting
This technique is one of the more widely known and popular techniques among threat actors. When a user object is configured with a service principal name (SPN), also known as service accounts, any other user object can request its ticket granting service (TGS) from a Domain Controller. This TGS ticket is encrypted with the user object's password hash. Once the threat actor has this, they can take the hash offline and crack it, which in turn can reveal the plaintext password of that service account. If the service account in question has administrative privileges, the threat actor now has access to a privileged account and can pivot deeper into the network. Many common "red team" tools help automate the Kerberoasting process, such as Mimikatz, Rubeus, and Impacket.
Since this functionality is a built-in feature of Windows, Kerberoasting cannot be blocked outright. However, several steps can be taken to make it a non-viable option for the attacker:
Password Spraying
Password spraying is when a threat actor attempts to authenticate to multiple user objects using a single password, or a small set of passwords. These passwords are typically found in wordlists or 3rd party data breaches, where common/weak passwords are frequently observed. By "spraying" these weak passwords across many or all user accounts, the threat actor hopes that at least one user is using the same weak password. Even in 2026, weak passwords are still extremely common, and users tend to reuse passwords across multiple accounts, making this technique extremely effective. It is also more difficult to detect as it does not trigger account lockouts for failed password attempts.
Dumping ntds.dit
The ntds.dit file is the New Technology Directory Services Directory Information Tree, and is the AD Domain Services database that stores information about all objects in the domain, including password hashes for user and computer objects. A copy of this file is stored on every domain controller (except read-only Domain Controllers), and is frequently targeted by threat actors. Any user object that can log on to Domain Controllers, such as members of the Domain Admins security group, can access the ntds.dit file. Since some of the information in the ntds.dit file is encrypted, threat actors will also need to retrieve the SYSTEM hive from the registry of the same Domain Controller that they obtained the ntds.dit file. If the threat actor successfully obtains the ntds.dit file and the SYSTEM hive, they can decrypt the ntds.dit file and then attempt to crack every password hash for every user and computer object in the domain.
Conclusion
These summaries only scratch the surface of the wealth of information in this document. As mentioned above, it is highly recommended that security teams and network administrators review the document and implement the hardening and detection recommendations. Hardening Active Directory is one of the best things organizations can do to protect their network from modern threat actors.
Resources:
Vulnerability Roundup
Yet another Patch Tuesday vulnerability record was broken this month, with Microsoft addressing 975 new vulnerabilities. This massive increase in vulnerability findings is due to the use of AI tools to audit their source code. The security updates for September include fixes for two vulnerabilities that are under active exploitation, CVE-2026-85880 and CVE-2026-81963 (see the CISA KEV list below for more details). Regular patching of Windows systems is always important, but with the ever-increasing volume of vulnerabilities that are disclosed and fixed each month, it is important that administrators stay up-to-date on Windows patch cycles.
https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep
https://thehackernews.com/2026/09/microsoft-patches-record-974-flaws.html
Cisco has disclosed a maximum-severity vulnerability in their Identity Services Engine (ISE) that is under active exploitation. Tracked as CVE-2026-76460, the vulnerability allows an unauthenticated remote attacker to bypass authentication. It affects Cisco ISA and Cisco ISE Passive Identity Connector (ISE-PIC), regardless of device configuration. The table below shows the fixed release versions:
Fig. 1: Cisco ISE Fixed Release Versions | Source: Cisco
Administrators are urged to patch as soon as possible as this vulnerability is under active exploitation. Cisco also strongly urges administrators to review the access.log file on ISE servers to look for suspicious usernames. Details of how to review this file can be found in the Cisco advisory here.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-ABP-VNSW7Tn5
https://thehackernews.com/2026/09/cisco-warns-of-new-zero-day-ise-auth.html
Cisco recently disclosed a critical vulnerability in their Secure Firewall Management Center. Tracked as CVE-2026-20324, successful exploitation can allow for a remote authenticated attacker to execute arbitrary commands as root. This vulnerability affects all Cisco Secure FMC Software if sftunnel is enabled (this feature is enabled by default). For further information on the sftunnel protocol from Cisco, read the documentation here. Administrators are urged to apply the patch as soon as possible.
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-sftunn-codex-c3O4Jft2
https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215540-configure-verify-and-troubleshoot-firep.html
On September 9, Check Point addressed two critical vulnerabilities in their VPN products. The first, CVE-2026-85102, is an authentication bypass and remote code execution (RCE) flaw in Remote Access and Site-to-Site VPN. The second, CVE-2026-85103, is a buffer overflow flaw during the ASN.1 decoding of a VPN certificate that can lead to RCE. Both vulnerabilities affect the same versions:
A week later, Check Point disclosed a critical vulnerability in their Security Management and Log Servers. Tracked as CVE-2026-91843, this stack-based buffer overflow flaw in the login process for these server instances allow an unauthenticated remote attacker to execute arbitrary code with root privileges. This vulnerability affects the following versions:
Administrators are urged to patch as soon as possible.
https://community.checkpoint.com/t5/General-Topics/Action-Required-Critical-Security-Advisory-VPN-Vulnerabilities/td-p/281995
https://community.checkpoint.com/t5/General-Topics/Important-Notification-Action-required-Critical-Security-Update/m-p/282409
https://thehackernews.com/2026/09/check-point-discloses-two-98-rated-vpn.html
SolarWinds released a patch for CVE-2026-28326, an unauthenticated remote code execution (RCE) vulnerability due to a hardcoded static key in SolarWinds Access Rights Manager. The flaw affects SolarWinds ARM 2026.2 and all previous versions. Administrators are urged to patch as soon as possible.
https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28326
https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html
The following vulnerabilities were added to CISA's Known Exploited Vulnerabilities Catalog in the last 2 weeks:
This report is provided FREE to the cybersecurity community.
Visit our Cyber Threat Intelligence Blog for additional reports.
Visit our Cyber Threat Profile Blog for detailed intelligence profiles.
Visit our Beyond the Threat Feed Blog for more articles.
Subscribe to be notified of future Reports:
NOTE
We have enhanced our report with data from SOCRadar. You may need to register to view their threat intelligence content.