CISA, ASD’s ACSC, and Partners Update Guidance on Detecting and Mitigating Active Directory Compromises

Today, the Cybersecurity and Infrastructure Security Agency (CISA), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), and partners updated joint guidance, Detecting and Mitigating Active Directory Compromises. First published in September 2024 and last updated in January 2025, this guidance describes 17 common techniques threat actors use to compromise Microsoft’s Active Directory. The updates provide an expansion to the "Detecting DCSync" and "Shadow Credentials" sections, highlighting new methods for threat actors to gain access to accounts in a Windows domain while evading detection.

Because it sits at the center of identity and access, compromising Active Directory often equates to compromising the entire enterprise, allowing malicious actors to access systems, data, and business applications. As such, it remains a primary target for malicious cyber activity. Compromise can enable adversaries to escalate privileges, move laterally, establish persistence, and, in many cases, gain broad control of enterprise and cloud resources.

Key themes include:

• understanding and baselining Active Directory;
• detecting common credential theft and authentication compromises;
• hardening Active Directory configuration to prevent privilege escalation and persistence;
• identifying indicators of full domain compromise; and
• strengthening monitoring and logging.

CISA encourages stakeholders, particularly identity and directory service administrators, security operations teams, and incident responders, to review and incorporate the recommended detection and mitigation techniques into their Active Directory security program and defensive operations. Read the updated guidance to learn more.

Please share your thoughts with us through this anonymous survey. We appreciate your feedback.

This product is provided subject to this Notification and this Privacy & Use policy.