Raising the cost of attacks: Hardening AD
The Authentication Insights Newsletter
Hello,
Welcome back to Authentication Insights.
In our last issue, we walked through how attackers move from a single foothold to Domain Admin. This time, let's look at the defender's side of that story: attackers don't need to break your defenses, they just need to find the path of least resistance. The mandate isn't to make AD impenetrable. It's to make every step forward so slow and painful that it isn't worth taking.
As Evgenij Smirnov puts it in Building a Modern Active Directory: "Instead of trying to harden AD and all the systems around it until they become unusable … we will engineer our AD in a way that makes every phase of an attack as expensive as possible while still providing required functionality to legitimate users and applications."
We can't go into AD hardening in detail here, but here are a few ways to make sure any gains cost a greater amount of time, skill, or money.
NTLM keeps biting modern AD environments. If attackers steal the underlying hash, they don't need the password, and relay attacks are trivial because there's no client preauthentication.
Almost no one disagrees that disabling NTLM is the end goal. But it's hardcoded into third-party integrations and present in many legacy apps.
The practical path isn't a switch-flip. It means auditing where NTLM is actually used, then ratcheting up the restriction level from there.
Kerberos is the better protocol, but "better" isn't "safe by default." Three gaps stand out:
The krbtgt account: every DC shares its hash. Compromise it, and an attacker forges Golden Tickets at will.
Legacy ciphers: RC4 has been deprecated but remains enabled by default in most environments, and because the RC4-HMAC encryption key equals the account's NT hash, stolen hashes can be used to request Kerberos tickets. Kerberoasted RC4 tickets are crackable offline; AES-encrypted tickets are far more resistant to the same attack.
Any account flagged "Do not require Kerberos preauthentication" is open to AS-REP roasting. There's really no reason to have that setting enabled.
Since Active Directory doesn't have built-in authentication tracking, it can't, by design, keep a ledger of every ticket it issues. That blind spot is exactly what attackers count on.
The hardening that makes an attack expensive only works if you can see the attempt.
Spencer Alessi, Microsoft MVP and Sr. Pentester at SecurIT360, recommends creating an attack path kill list:
An Attack Path Kill List is just a fancy saying for identifying where potential attack paths exist in your environment, then mitigating or eliminating them with defensive controls.
Identify Attack Paths
Prioritize Remediations
Fix, Re-test
Repeat
You secure AD by understanding how an attacker would move, then removing the paths that let them succeed.
In our next issue, we'll look at why you can't defend what you can't see, and practical ways to get better visibility.
Looking to go deeper on AD hardening and attack paths? These reads can help:
Until next time,
The Authentication Insights Team