From domain data to defensible identity security decisions.

Ransomware groups utilize this tactic to obtain an authenticated position within Active Directory, which then leads to more advanced attacks. It's often one of the first attacks carried out once access to the internal network is obtained.

Accidental deletion protection guards against mistakes, not attackers: it is a deny entry in the OU's permissions, and anyone who controls the OU can remove it before deleting. Its value is operational. Deleting an OU deletes every user, computer, and group in it, and recovering them takes the Active Directory Recycle Bin or an authoritative restore, during which the affected accounts cannot sign in.

Recycle bin disablement signify to attackers that configurations may not be at baseline and embolden attacker actions.

Disabling an account blocks new interactive sign-in but does nothing to the AD rights already granted to it, so a disabled sync account that still sits in a privileged group or holds DCSync rights is functionally still a live credential to anyone who captured its hash before it was disabled. Attackers specifically look past the Enabled flag during reconnaissance for this exact reason: a disabled account with retained privilege is often assumed safe and excluded from monitoring, even though re-enabling it or replaying a previously captured Kerberos ticket works exactly as it did before.

A duplicate AZUREADSSOACC-pattern object is an easy way to hide in plain sight, most tooling assumes exactly one object per synchronized forest, so a second one can go unmonitored indefinitely. An attacker who plants a look-alike object, or repurposes a stale one left over from a migration, gains a persistence mechanism that blends into what already looks like expected hybrid identity infrastructure. Because the real trust anchor and the duplicate share a naming convention, defenders scanning by name alone can miss which one is actually live.

Every extra enabled sync-pattern account is a fully separate, often forgotten credential carrying the same class of sensitive AD rights as the legitimate one, without adding any real synchronization capability. Attackers who find several accounts matching this naming convention will simply target whichever one has the weakest password, the broadest permissions, or the least monitoring, since compromising any one of them is equally effective.

Attackers specifically hunt for exactly this kind of forgotten identity during reconnaissance: an enabled account that nobody is watching, still carrying whatever AD rights its original sync role required. A captured hash or Kerberos ticket for an orphaned sync account works exactly as well as one for an actively used account, and because nobody expects it to authenticate, unusual activity from it is far less likely to trigger a second look.

AZUREADSSOACC$ has a long, randomly generated password, so a service ticket requested for one of its SPNs cannot be cracked offline the way an ordinary service account's can. The account matters for a different reason: its Kerberos key is what Microsoft Entra ID uses to validate Seamless SSO tickets, and an attacker who obtains that key, for example through DCSync, can forge tickets that Microsoft Entra ID accepts for any synchronized user. An SPN that Microsoft does not register is either a configuration error or a sign that someone with write access to the account has changed it, so investigate it before removing it.

Without the 'sensitive and cannot be delegated' flag, a captured ticket for AZUREADSSOACC$ can be forwarded and reused by any other system in the domain that is configured for unconstrained delegation, a far more common misconfiguration than one on this account itself. An attacker doesn't need to touch AZUREADSSOACC$ directly; they only need to compromise one of those other systems and wait for it to authenticate. This flag is the one control standing between the account and a delegation path it never chose.

RC4-encrypted tickets derive their key directly from the account's NTLM hash, which is comparatively cheap to crack offline with Hashcat compared to AES. An attacker who captures an RC4 service ticket for AZUREADSSOACC$ through Kerberoasting or a network capture gains a materially easier path to recovering the account's password than AES-only encryption would allow, on an account that already sits at a sensitive trust boundary.

As organizations increasingly rely on Endpoint Detection and Response (EDR) tools, attacks on Active Directory are expected to rise. It is crucial to ensure that proper logging from domain controllers is sent to a SIEM and alerting is in place.

Attackers exploit this by breaking weaker cryptographic protections to impersonate trusted services or decrypt sensitive data. Using tools like RsaCtfTool or John the Ripper, they can factorize short RSA keys, allowing them to forge signatures or eavesdrop on encrypted communications. This enables them to compromise secure channels, intercept confidential information, and gain unauthorized access to critical systems.

PowerShell has become highly popular among hackers due to its extensive functionality, leading to the creation of numerous tools that leverage it. It is commonly used by malicious attackers as part of their toolkit.

Attackers leverage the "Pre-Windows 2000 Compatible Access" group to gain broad read access to directory information, including user and group details. They use this access to gather intelligence on the organization’s structure and potentially escalate privileges or craft targeted attacks.

Recently tools have been released focusing on exploiting Pre-Windows 2000 computer accounts, making it a common technique for gaining an initial foothold in a network. These accounts can sometimes obtain an authenticated domain account, as their default password is defaulted to the hostname in all lowercase letters. If these accounts were created but never used, they are likely still configured with this default setting.

Static service-account passwords are a perennial weak point: they are often weak, shared, embedded in scripts, and never rotated, which makes them ideal Kerberoasting targets and lateral-movement credentials.

The "Pre-Windows 2000 Compatible Access" group is typically leveraged to gain broad read access to directory information, including user and group details. With access, attackers can gather intelligence on the organization’s structure and potentially escalate privileges, or craft targeted attacks, such as spear phishing or password attacks.

Recently, tools have been released to exploit Pre-Windows 2000 computer accounts, making it a common technique for gaining an initial foothold in a network. These accounts can sometimes be used to obtain an authenticated domain account, as their default password is defaulted to the hostname in all lowercase letters. If these accounts were created but never used, they are likely still configured with this default setting.

Schema group members are a prime target for attackers, specifically if they are looking to cause denial of service attacks.