Active Directory Security
Categories
- Active Directory Backup & Recovery (69)
- Active Directory Security (241)
- AD Security 101 (18)
- Community Tools (26)
- Crisis Management (5)
- Directory Modernization (10)
- From the Front Lines (70)
- Hybrid Identity Protection (86)
- Identity Attack Catalog (32)
- Identity Threat Detection & Response (171)
- Our Mission: Be a Force for Good (14)
- Purple Knight (6)
- Semperis University (5)
- The CISO's Perspective (18)
- Threat Research (79)
- Uncategorized (3)
Defending Against Cable: Prevent Malicious Use of Post-Exploitation Tool
- Huy Kha | Senior Identity & Security Architect
Post-exploitation tools—such as Cable, the Active Directory-specific pentesting tool—are meant to educate security teams. But attackers use them too. Here’s how to detect and defend against malicious use of the Cable tool.
ESC1 Attack Explained
- Huy Kha | Senior Identity & Security Architect
Discover how certificate template misconfigurations in Active Directory Certificate Services (AD CS) enable ESC1 attacks—allowing cyber attackers to rapidly escalate privileges and potentially compromise entire networks.
AD Security: How to Use Delegation of User Management and Windows Password Options
- Guido Grillenmeier | Principal Technologist, EMEA
Permission delegation in Active Directory can be complex. Learn how you can use Windows password options with delegation management to support your user management structure without sacrificing AD security.
How to Automatically Undo Risky Changes in Active Directory
- Huy Kha | Senior Identity & Security Architect
For most organizations, manually auditing and rolling back every risky Active Directory change isn’t practical—or even possible. Discover how the Auto Undo feature in DSP works to automate change mitigation to protect sensitive AD and Entra ID objects and attributes.
Pass the Hash Attack Explained
- Huy Kha | Senior Identity & Security Architect
Cyber attackers can choose from numerous credential compromise methods to gain access to Active Directory. The Pass the Hash attack is one that is stealthy and efficient.
Hospital Cyberattacks Highlight Importance of Active Directory Security
- Michael Choo
Two back-to-back incidents—part of a global increase in cyberattacks on healthcare organizations—followed common pathways to exploit AD security vulnerabilities.
Introduction to Identity Forensics & Incident Response (IFIR)
- Huy Kha | Senior Identity & Security Architect
From my experience at Microsoft Detection and Response Team (DART), I know that ransomware operators almost always target high-privileged identities. Once attackers gain control, they use those identities to spread ransomware; for example, through Group Policy or PsExec. Ransomware attacks are usually loud and destructive, aiming to cause maximum impact…
Leveraging NIST CSF for Public Sector Cybersecurity
- Edward Amoroso
[Editor’s note: This article is a guest post by TAG CEO and founder Ed Amoroso.] Cybersecurity practitioners working for federal agencies in the United States know that they must learn to decode various acronyms such as FedRAMP, FISMA, RMF, and on and on. They must do so because the standards…
