ASD and partners update their Active Directory compromise guidance to 18 techniques
The update adds a new way to detect DCSync and a new section on shadow credentials.
Affects
Active Directory
What to do
Review Active Directory against the 18 techniques, starting with DCSync and shadow credentials.
- Guidance updated
Who wrote it
ASD wrote the guidance with CISA, the NSA, the Canadian Centre for Cyber Security, New Zealand's NCSC and the UK's NCSC.
What to do now
ASD warns that a determined attacker can persist in Active Directory for months or years, and that eviction can mean resetting every password or rebuilding the directory.
- Map the directory with a tool such as BloodHound, PingCastle or Purple Knight, and fix the attack paths it shows.
- Check which accounts hold replication rights, since those are what DCSync abuses.
- Audit the msDS-KeyCredentialLink attribute on users and computers for shadow credentials nobody issued.
- Turn on the directory events the guidance recommends, and send them to central logging.
- Plan a KRBTGT password reset and a tiered administration model for privileged accounts.
Who is affected
Any organisation running on-premises Active Directory, including those that synchronise it to Microsoft Entra ID. ASD notes that every user in a domain has enough permission to discover weaknesses, so the attack surface is the whole directory.
Detection notes
The guidance gives mitigation and detection advice for each technique. These signals cover several at once.
- Replication requests from a host that is not a domain controller
- Changes to msDS-KeyCredentialLink outside a device enrolment
- Kerberos service ticket requests in bulk from one account
- New members of privileged groups, and changes to AdminSDHolder
Essential Eight mapping
Restrict administrative privileges and multi-factor authentication carry most of the mitigations in the guidance. Patch operating systems applies to domain controllers.
Sources
- PrimaryASD, Updated guidance on detecting and mitigating Active Directory compromises (14 September 2026)Retrieved 25 Oct 2026
- PrimaryASD, Detecting and mitigating Active Directory compromisesRetrieved 25 Oct 2026
