Skip to content
AI Security

Lesson 7 of 9 · 7 min read

Active Directory Attack Paths and How Tiering Breaks Them

Active Directory compromises usually follow a path: a phished user, a shared local administrator password, a privileged credential cached on a workstation, a relayable authentication or a misconfigured certificate template, and then control of the domain. Each step is an edge in a graph, and defence means removing edges: Windows LAPS for unique local passwords, Protected Users and Credential Guard for privileged credentials, signing, channel binding and EPA against NTLM relay, careful AD CS templates, and an administrative model in which higher planes are never controlled from lower ones.

Premium lessonReviewed By the AISecurityInterviews editorial team
Get full Premium access · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

Practise it as an interviewer asks it

Detection Engineering & Incident ResponseA standard user account suddenly appears in the Domain Admins group. How do you investigate how it happened and what else changed?Identity, OAuth & Access ControlHow do SAML single sign-on and Kerberos work at a high level, and where is trust anchored?Systems, OS & Memory SafetyHow does Kerberos work in Active Directory, and how do Kerberoasting, Golden Tickets and delegation abuse exploit it?Security Foundations & Threat ModelingIn an internal network assessment, how does a single foothold usually turn into domain control, and which controls break that path?Detection Engineering & Incident ResponseHow would you use honeytokens and deception to detect an intruder, and how do you keep them from creating risk or noise?Systems, OS & Memory SafetyHow does obfuscation work, from string encryption and control-flow flattening to packing and virtualisation, and how is each undone?

Related lessons

Windows and Active Directory Security for InterviewsThe Linux Privilege Model: Permissions, setuid, Capabilities and MACIncident Handling: Declare, Contain, Scope, Recover, LearnEndpoint and Network Telemetry for DetectionThe Confused Deputy