Active Directory Attacks—Steps, Types, and Signatures

Abstract

Active Directory Domain is a Microsoft service that allows and facilitates the centralized administration of all workstations and servers in any environment. Due to the wide use and adoption of this service, it has become a target for many attackers. Active Directory attacks have evolved through years. The attacks target different functions and features provided by Active Directory. In this paper, we provide insights on the criticality, impact, and detection of Active Directory attacks. We review the different Active Directory attacks. We introduce the steps of the Active Directory attack and the Kerberos authentication workflow, which is abused in most attacks to compromise the Active Directory environment. Further, we conduct experiments on two attacks that are based on privilege escalation in order to examine the attack signatures on Windows event logs. The content designed in this paper may serve as a baseline for organizations implementing detection mechanisms for their Active Directory environments.

Mengoptimalkan Manajemen Dan Keamanan Ti Melalui Implementasi Layanan Domain Active Directory Studi Kasus Pada Infrastruktur Ti Perusahaan

“…Berdasarkan analisis tersebut, penelitian ini mengusulkan implementasi AD DS sebagai solusi untuk memperoleh kontrol yang lebih baik atas pengguna dan sumber daya jaringan [7]. Implementasi ini diharapkan tidak hanya mengurangi insiden keamanan, seperti kata sandi yang lemah dan akses tidak sah, tetapi juga memungkinkan manajemen TI untuk mengelola kebijakan secara terpusat, mengatur hak akses sesuai dengan kebutuhan spesifik divisi, dan mengontrol instalasi aplikasi.…”