Identity Attack Catalog
Categories
- Active Directory Backup & Recovery (64)
- Active Directory Security (221)
- AD Security 101 (17)
- Community Tools (19)
- Directory Modernization (9)
- From the Front Lines (69)
- Hybrid Identity Protection (68)
- Identity Attack Catalog (31)
- Identity Threat Detection & Response (146)
- Our Mission: Be a Force for Good (14)
- Purple Knight (5)
- Semperis University (4)
- The CISO's Perspective (16)
- Threat Research (68)
Group Policy Preferences Abuse Explained
- Huy Kha | Senior Identity & Security Architect
- May 13, 2025
The Group Policy Preferences feature provides a well-known pathway for cyber attackers to discover easily decoded passwords in Active Directory. Learn to spot and defend against this vulnerability.
ESC1 Attack Explained
- Huy Kha | Senior Identity & Security Architect
- May 01, 2025
Discover how certificate template misconfigurations in Active Directory Certificate Services (AD CS) enable ESC1 attacks—allowing cyber attackers to rapidly escalate privileges and potentially compromise entire networks.
Pass the Hash Attack Explained
- Huy Kha | Senior Identity & Security Architect
- Apr 09, 2025
Cyber attackers can choose from numerous credential compromise methods to gain access to Active Directory. The Pass the Hash attack is one that is stealthy and efficient.
NTDS.DIT Extraction Explained
- Huy Kha | Senior Identity & Security Architect
- Apr 06, 2025
The Five Eyes report on Active Directory compromise lists NTDS.DIT extraction as a top attack tactic. With access to this file, attackers might be able to extract passwords hashes, which they can lead to a complete compromise of Active Directory. Learn more about NTDS.DIT extraction, how to detect it, and…
Microsoft Entra Connect Compromise Explained
- Huy Kha | Senior Identity & Security Architect
- Mar 28, 2025
In hybrid identity environments, attackers that manage to breach either the on-premises Active Directory or cloud-based Entra ID typically attempt to expand their reach throughout your identity environment. If your identity infrastructure includes Entra ID, make sure you understand how to detect and defend against Entra Connect compromise. What is…
LDAP Reconnaissance Explained
- Huy Kha | Senior Identity & Security Architect
- Mar 06, 2025
Lightweight Directory Access Protocol (LDAP) reconnaissance is an approach that enables attackers to discover valuable details about an organization, such as user accounts, groups, computers, and privileges. Learn how to detect LDAP reconnaissance and how cyberattackers can use this method as part of an attempt to compromise your environment. What…
Group Policy Abuse Explained
- Huy Kha | Senior Identity & Security Architect
- Feb 27, 2025
Group Policy is a key configuration and access management feature in the Windows ecosystem. The breadth and level of control embodied in Group Policy Objects (GPOs) within Active Directory make Group Policy abuse a popular method for attackers who want to establish or strengthen a foothold in your environment. Here's…
Password Spraying Explained
- Huy Kha | Senior Identity & Security Architect
- Feb 22, 2025
Password spraying is a top cyber threat, named in the recent report from the cybersecurity agencies in the Five Eyes alliance. What is password spraying, how have cyberattackers used it in the past, and how can you detect and defend your hybrid Active Directory environment against password spraying attacks? What…
