Loading…
MITRE ATT&CK-based attack techniques — Exploit · Prevention · Detection
7 techniques · Credential Access
A comprehensive map of NT hash, Kerberos ticket, and plaintext password theft via memory dumping of Windows authentication backbone LSASS (lsass.exe): Mimikatz/sekurlsa, comsvcs LOLBin, ProcDump, and nanodump attack methods; Sysmon EID 10 GrantedAccess masks + Sigma-based technical detection; Credential Guard, RunAsPPL, WDigest disable, and ASR rule hardening controls.
A comprehensive map of ticket-based attacks against the Active Directory Kerberos protocol: how they work → how to detect them → how to prevent them for Kerberoasting (T1558.003), AS-REP Roasting (T1558.004), Golden/Silver Ticket (T1558.001/002), Pass-the-Ticket (T1550.003), and delegation abuse; including RC4 etype 0x17 / CVE-2026-20833 transition context and the AES Kerberoasting blind spot.
A comprehensive map of the attack surface on the OAuth permission model of Microsoft Graph API: illicit consent grant (T1528), service principal credential addition (T1098.001), application role escalation chains (T1098.003), and high-risk permission abuse. For each technique, Entra ID audit signals, KQL/Sigma, and hardening controls are provided.
A comprehensive map of attacks targeting NTLM authentication in on-premises Active Directory environments: LLMNR/NBT-NS poisoning and NetNTLM hash harvesting (Responder), forced authentication (PetitPotam MS-EFSRPC/CVE-2021-36942, PrinterBug MS-RPRN, DFSCoerce MS-DFSNM, ShadowCoerce), NTLM relay (SMB→LDAP/LDAPS/ADCS ntlmrelayx chain), Pass-the-Hash, NTLMv1 downgrade, and countermeasures (SMB signing, EPA, LDAP channel binding, Protected Users, mitm6). The detection-prevention triad for SOC, DFIR, and red/purple teams.
Three layers of Kerberos delegation exploitation: unconstrained (TrustedForDelegation + coercion for DC TGT harvesting), constrained (S4U2Self/S4U2Proxy + altservice trick), and resource-based constrained delegation (RBCD + MachineAccountQuota abuse). Printer Bug, PetitPotam, DFSCoerce coercion chains; Bronze Bit (CVE-2020-17049); Protected Users and Sensitive exemptions. Conceptual attack flows with Rubeus and impacket getST.py; detection rules based on 4624/4741/5136; hardening with MAQ=0, tiering, and ACL auditing.
A comprehensive map of attacks targeting the Microsoft Entra ID (formerly Azure Active Directory) identity model: technical reference for purple/red teams and SOC teams, from token theft, device code phishing, Golden SAML, and managed identity abuse through to detection and hardening.
Active Directory Certificate Services (AD CS), when misconfigured, can allow a low-privileged user to obtain a Domain Admin certificate and fully compromise the domain via PKINIT. This article provides an in-depth examination of all escalation techniques from ESC1 through ESC16, the PKINIT chain, KB5014754 strong certificate mapping, and comprehensive defense controls. It is a technical reference for authorized red/purple team exercises and SOC/DFIR teams.
