Identity and Active Directory security
Analyse accounts, delegations and sensitive groups, then build a prioritised remediation path.
Identity security
Secure Active Directory and reduce attack paths
Understand how one identity, one delegation or one misconfiguration can lead all the way to your most sensitive resources.
A list of vulnerabilities does not tell you what is actually reachable. An attack path does: it links an ordinary identity to a critical asset, and it is fixed by order of effect.
Does this sound familiar?
- Groups and delegations have piled up over the years.
- Privileged accounts are numerous or poorly segmented.
- Dormant and orphaned accounts remain.
- Sensitive changes go unmonitored.
- Teams know the vulnerabilities, but not the exploitation paths.
- Remediation is not prioritised by real effect.
What you are trying to achieve
- Visualise the attack paths.
- Identify accounts and groups at risk.
- Remove dangerous delegations.
- Fix the configurations that matter first.
- Monitor changes.
- Detect abnormal interaction with sensitive assets.
The Ariovis capabilities involved
Each offer keeps its own role. Here is exactly what it brings to this situation.
Privileged access and secrets
Remove the standing privileges that feed the shortest attack paths.
Trapster — Deceptive Security
Place decoys along the identified paths to detect progression as early as possible.
Identity and access penetration testing
Confront the analysis with real exploitation and verify what is genuinely reachable.
IAM operations
Monitor sensitive changes and hold the level reached after remediation.
Understanding the main Active Directory attack techniques
An Active Directory attack path rarely relies on a single misconfiguration. An attacker combines identities, rights, protocols, service accounts and trust relationships to move towards a more sensitive resource. Knowing the techniques involved helps identify the paths that are genuinely exploitable, and above all where to break them.
Service accounts
Kerberoasting
Request a service ticket for an account carrying an SPN, then attempt to crack the protecting password offline.
Kerberos configuration
AS-REP Roasting
Abuse accounts exempted from Kerberos pre-authentication to obtain material that can be attacked offline.
Tier 0 / critical · MITRE T1003.006
DCSync
Abuse Active Directory replication rights to access domain secrets without directly extracting NTDS.dit.
Legacy protocols
NTLM Relay
Relay a legacy authentication to another service in order to act with the rights of an identity you do not control.
Lateral movement
Pass-the-Hash
Reuse a password hash collected on a workstation to authenticate elsewhere, without ever knowing the password.
Lateral movement
Pass-the-Ticket
Reuse a valid Kerberos ticket to extend access or move towards a more sensitive resource.
Delegations
Kerberos delegation
Divert a poorly scoped delegation to impersonate another user, sometimes up to an administrative identity.
Active Directory PKI
AD CS — ESC1
A misconfigured certificate template can let a low-privileged identity request a certificate usable to authenticate as another identity. ESC1 shows why an AD CS PKI can create a path towards Tier 0 without directly compromising a domain controller.
A technique is not an attack path
Kerberoasting, DCSync or Pass-the-Hash are not, on their own, a complete attack. They are steps an attacker chains together when the environment allows it.
The risk comes from the chain, not from the isolated technique.
- Compromised identity
- Discovery of what is reachable
- Secret obtained or abused
- Privilege escalation
- Lateral movement
- Access to a critical identity or resource
Detecting each technique separately is not enough. What matters are the relationships between identities, privileges and resources that let an attacker chain several steps up to a critical asset.
Spotting a technique is not enough: the path has to be broken
Remediation is not about adding another tool. It is about removing the conditions that make the chain possible, starting with the fixes that eliminate the largest number of paths.
- Remove unnecessary privileges and standing rights.
- Review service accounts, their SPNs and their secrets.
- Fix delegations that are too broad or purely historical.
- Remove misconfigurations and legacy mechanisms.
- Protect privileged identities and administration paths.
- Harden Active Directory and its PKI.
- Monitor sensitive changes and behaviours.
- Strengthen identity and entitlement governance.
Where to start
Map critical assets, privileged identities, delegations and the main paths leading to them.
- 01Define what really matters: domain controllers, critical applications and data.
- 02Analyse the groups, delegations and ACLs granting access to them.
- 03Reconstruct the shortest paths from an ordinary identity.
- 04Prioritise remediation by the number of paths it removes.
Related use cases
To keep reading on situations that touch the same surface: technical identities, standing privileges, APIs and application access.
Access and privileges
Reduce standing privileges
Replace permanent administrative rights with proportionate, temporary and traceable access.
Access and privileges
Govern service accounts and secrets
Take back control of legacy technical identities: their owners, their secrets and their privileges.
Identity security
Prevent data breaches
Stop a legitimate or compromised identity from reaching too much data, for too long, without anyone noticing.
A Practical Starting Point
A short format, already online, to get an objective view of your situation before committing to a project.
- Active Directory Security
Active Directory Security
Gives a maturity score and prioritised risks to start the first remediations.
See It in Practice
Real engagements whose approach sheds light on this situation.
Sector : Non-profit
Rationalizing an IAM landscape around Microsoft
A non-profit organization wanted to rationalize a heterogeneous IAM landscape, simplify operations and build a coherent identity foundation.
Illustrates a comparable approach to putting a Microsoft identity foundation back in order.
Read the case study : Rationalizing an IAM landscape around Microsoft
Explore the Topic
Our published content that speaks directly to this situation.
Replay
Securing Active Directory: from assessment to proactive protection
A useful replay on moving from a one-off assessment to change monitoring.
Field note
Privileges always tell a story
Shows how delegations and inherited privileges build attack paths.
Field note
NIS2 survival: secure your Active Directory in 90 days
A 90-day method to see, reduce and prove, in the NIS2 context.
Understand the Concepts
The notions worth sharing with your teams on this topic.
Does this use case look like yours?
Tell us about your context. Together we identify the priority capabilities and the first useful step.