---
title: "Attack paths: How today's attackers move through Active Directory | Authentication Insights"
description: "NTLM hashes, kerberos tickets, cached credentials, oh my! Here's how attackers move from initial foothold to full domain control. Read this issue of the Authentication Insights Newsletter to learn more."
locale: "en"
updated_at: "2026-09-18T15:11:17.114Z"
canonical: "https://www.isdecisions.com/en/authentication-insights/attack-paths-how-today-s-attackers-move-through-active-directory"
---

# Attack paths: How today's attackers move through Active Directory

The Authentication Insights Newsletter

Hello,

In our last newsletter, we looked at [why credential theft remains an easy win](/authentication-insights/why-credential-theft-still-works-in-active-directory) for attackers targeting Active Directory environments, even when MFA is deployed. Stealing authentication artifacts such as NTLM hashes, Kerberos tickets, and cached credentials is only the beginning.

Today, let’s go one level deeper: what does the attacker actually do with those artifacts, and what paths do they take from initial foothold to full domain control?

**Reconnaissance first, action second**

Attackers build a map before they move. A standard domain account gives a patient attacker enough read access to enumerate the environment thoroughly, and they don’t need Domain Admin on day one.

Three techniques do most of the heavy lifting:

- **Kerberoasting:** Query for service accounts with SPNs, request their Kerberos tickets, crack them offline. No special privileges required.
- **Session hunting:** Identify machines where privileged accounts currently have active sessions, then target those machines for credential material held in memory.
- **Misconfigured ACEs:** Delegation rights that look innocent in AD reports but that grant unexpected paths to privileged objects when group nesting is accounted for.

Each step feeds the next. Kerberoasting yields service account credentials that open doors to systems where privileged users are active. Session hunting identifies exactly which machines hold the credential material worth targeting. ACL abuse maps the shortcut to Tier 0 that AD's own reports won't show you. The attacker executes a sequence where every read-only query narrows the path to Domain Admin.

**The attacker’s highway**

Michael Waterman, identity security architect and author of the article "On-prem conditional access you never knew you had," frames what comes next as the “East-West highway.” Once inside, attackers move laterally over SMB, WinRM, RDP, WMI. These protocols designed for admin efficiency have become the attackers’ infrastructure.

Waterman highlights that most organizations know they need to or have already invested in North-South controls (perimeter firewalls, MFA, email filtering). East-West traffic inside the network is a different story, and it’s where the attack chain plays out.

The shift Waterman advocates for is from network-layer trust to identity-and-device trust: the question stops being “is this IP address allowed?” and becomes “is this the right user, on the right device, reaching the right service?”

**The attack chain now extends past authentication**

Tools like Tycoon 2FA industrialize a technique that sidesteps most MFA entirely, proxying a victim’s real login in real time to capture the post-authentication session cookie. Once attackers hold that cookie, they can replay it without further authentication. In many systems, no second challenge is triggered.

The techniques we talk about above (Pass-the-Hash, Pass-the-Ticket, credential reuse via stolen service account secrets) all depend on one important factor: authentication material being available somewhere an attacker can reach it. That's the problem to solve for.

For organizations that already have defenses like MFA in place, the defender’s battleground is shifting to post-authentication (we’ll talk more about this in a future issue).

*In our next issue, we'll look at what defenders can actually do: the **[concrete hardening actions](/authentication-insights/raising-the-cost-of-attacks-hardening-ad)** that make the path to Domain Admin longer, more expensive, and more visible.*

**Insights and practical tips**

Thinking about how to close gaps in authentication policy implementation? These reads can help:

- **[On-prem conditional access you never knew you had (Michael Waterman)](https://michaelwaterman.nl/2026/04/17/on-prem-conditional-access-you-never-knew-you-had/)**
- **[Containing the threat of privilege abuse and escalation](/blog/mfa/defending-active-directory-containing-the-threat-of-privilege-abuse-and-escalation)**
- **[Beyond passwords: how the Tycoon 2FA phishing kit works](/blog/mfa/beyond-passwords-how-the-tycoon-2fa-phishing-kit-challenges-mfa-security)**

Until next time,

The Authentication Insights Team