Active Directory has been the centre of gravity in Microsoft environments for more than two decades, and the attackers who target it have had plenty of time to develop techniques that look entirely legitimate to defensive tooling. Modern endpoint detection has improved dramatically, but the most damaging Active Directory attacks tend to use built-in features in unintended ways, which is exactly the territory where signature based detection struggles.
Living Off The Land Is The Default Now
Attackers stopped dropping suspicious binaries on disk years ago. PowerShell, WMI, scheduled tasks, group policy and the native administrative tooling provide everything a skilled threat actor needs to move through a Windows estate. Each of those tools is essential for legitimate administration, which means blocking them outright is not realistic. The defensive answer involves behavioural detection, careful logging and constraints on which accounts can use which tools from which hosts. A focused internal network pen testing engagement should mirror these techniques during testing so the gaps surface before a real adversary finds them.
Misconfigurations Beat Vulnerabilities
The most useful attack paths in Active Directory rarely involve unpatched software. They involve misconfigurations that have accumulated over years of administrative decisions. Excessive permissions on directory objects, weak service account passwords, kerberos delegation chains that nobody fully maps and stale accounts that retain elevated rights. None of these show up on a vulnerability scan. All of them appear in BloodHound output if anyone bothers to look.
Expert Commentary
William Fieldhouse, Director of Aardwolf Security Ltd
The most efficient domain compromise I worked on this year went from a low privileged user to domain administrator in four steps, none of which involved exploiting a single CVE. The path used kerberoasting, password reuse, an over-privileged service account and a forgotten resource based constrained delegation. Every step was visible to anyone running the right enumeration tools.
Tiered Administration Pays For Itself
Tiered administration restricts privileged credentials to specific hardened hosts. A tier zero administrator can only log on to tier zero systems. A tier one administrator can only log on to tier one systems. The discipline takes work to implement but produces durable benefits. A compromised workstation no longer hands an attacker domain administrator credentials, because those credentials were never used on the workstation in the first place. The migration to tiered administration takes deliberate work and produces durable results. Worth treating it as a multi-quarter programme with clear milestones rather than as a project that finishes. The benefits compound for as long as the discipline holds.
EDR Sees What You Configure It To See
A modern EDR product handles a great deal more telemetry than its predecessors, but it can only act on what it is configured to monitor. Many deployments arrive with default profiles that catch the obvious stuff and miss the subtle Active Directory abuse patterns entirely. Tune detections for the techniques that actually matter in your environment, and validate that tuning with a best pen testing company that runs the techniques and verifies what the EDR reports.
EDR is a useful tool. It is not a replacement for thinking about how your directory is actually configured. Active Directory remains the centre of gravity in most Windows environments. Worth investing in the security accordingly. Network security has changed considerably over the last decade and the principles that survived the change tend to be the ones worth investing in. The fundamentals remain valuable even as the implementation details evolve around them.