38. Active Directory Attacks and Defence
38.1 AD Basics for Defenders
Active Directory Domain Services – central authentication (प्रमाणीकरण) ani authorization for Windows. Domain = management boundary (example: sahyadri.lab). Forest = one or more domains that trust each other. Domain Controller (DC) = server that holds the directory database (NTDS) and answers Kerberos / LDAP.
Kerberos (default in domain): ticket-based. User proves password once to DC → gets TGT (Ticket Granting Ticket) → asks for service tickets (TGS) for file servers, SQL, HTTP SPNs. NTLM: older challenge-response; still appears for legacy / misconfig / local logons – attackers love it for relay.
LDAP role: query/modify directory objects (users, groups, computers, ACLs). Port 389 / LDAPS 636 – Chapter 37 madhe anonymous bind risk baghitla; AD madhe authenticated LDAP = BloodHound data source.
Why AD matters: ek Domain Admin compromise = almost full enterprise. Blue team job = reduce paths to DA, detect ticket abuse, harden legacy protocols. Samjla ka?
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Maps domain users/groups via LDAP after any foothold | Monitor LDAP volume spikes; require LDAPS; disable anonymous bind; alert on unusual bind accounts |
| Prefers Kerberos ticket theft / abuse over noisy password spray | Enable advanced audit (Kerberos TGT/TGS); watch Event ID 4768/4769 anomalies; MFA for admins |
| Looks for NTLM fallback hosts | Prefer Kerberos; disable NTLM where possible; SMB/LDAP signing |
Ravindra Bagale's Tip
Students "Domain Admin = Administrator local" gammatat. Local Admin ek machine; Domain Admin = almost saglya domain joined machines + DC rights. Interview madhe Tier-0 (DC/identity) vs Tier-1 (servers) vs Tier-2 (workstations) sanga – Microsoft Enterprise Access Model idea. He lakshat theva.
Lab
Notes madhe ek table banava: Domain / Forest / DC / TGT / TGS / NTLM – ek-ek line definition (swatahchya shabdat). Fictional org: Sahyadri Traders, Pune, domain sahyadri.lab. Shraddha Bagale (helpdesk) vs Raja (Domain Admin) – kontya Tier madhe? 5 sentences liha.
Real incident: SolarWinds Orion supply-chain (2020)
Public reporting (CISA / FireEye Mandiant) described attackers abusing a trusted software update path, then moving toward identity systems and privileged access in victim environments. Weakness theme: trust in software + privileged identity. Defence mindset: least privilege, Tier isolation, monitor unusual directory / IdP activity, patch supply-chain monitoring. Source: CISA alerts and Mandiant public reports on SUNBURST / related activity (verify URLs).