Skip to content
BreachPathAttack Path LibraryStart
AdvancedAccount takeover

Stolen credentials to domain administrator

A single reused password gets a foothold in Active Directory, which is turned — through service-account weaknesses and credential reuse — into full domain-administrator control.

Technologies
On-premises Active Directory
Entry points
Stolen credentials, Phishing
Sectors
Professional services, Manufacturing, Financial services…
Stages
3
01

A reused credential provides a domain foothold

The attacker uses a credential recovered from an unrelated breach or a phishing lure that also works internally, gaining an authenticated position in Active Directory as a standard user.

Attacker objective

Authenticate to the domain as a real, if low-privileged, user.

MITRE ATT&CK
Controls that should stop this
  • MFA on all authentication surfaces, including internal ones where feasible
  • Banned-password and breached-password screening
  • Lockout and anomaly detection on authentication
What defenders should see
  • Authentication spikes or spraying patterns across many accounts
  • Successful logon from an unusual host or time
  • Sign-ins matching known-breached credential lists
What a pentest validates
  • Password-spray and credential-reuse assessment
  • Review of breached-password screening
  • Test detection of spraying and anomalous logon
Business impact

The attacker holds a legitimate domain identity to build on.

02

Weak service accounts are targeted for escalation

The attacker enumerates the directory for privileged service accounts with weak or recoverable credentials and for accounts whose access can be requested, then works offline to recover a stronger credential.

Attacker objective

Recover credentials for a more privileged account from directory weaknesses.

MITRE ATT&CK
Controls that should stop this
  • Strong, managed passwords for service accounts (or group-managed service accounts)
  • Least privilege for service accounts; no unnecessary admin rights
  • Monitoring for large-scale service-ticket requests
What defenders should see
  • Unusual volume of service-ticket requests from one account
  • Enumeration of service-principal names
  • Privileged service-account logons from unexpected hosts
What a pentest validates
  • Test for service accounts with weak or recoverable credentials
  • Review service-account privilege and password management
  • Validate detection of large-scale ticket requests
Business impact

The attacker obtains a more privileged credential than they started with.

03

Domain-administrator control is reached

Using the elevated account and any credential material exposed on reachable systems, the attacker reaches domain-administrative privilege, giving them authority over every domain-joined system.

Attacker objective

Escalate the recovered privilege to full control of the domain.

MITRE ATT&CK
Controls that should stop this
  • Tiered administration and privileged access workstations
  • Credential-theft protections on endpoints and servers
  • Just-in-time, monitored privileged access
What defenders should see
  • Credential-access alerts from endpoint detection
  • Privileged logons spreading across many hosts
  • Privileged-group membership changes
What a pentest validates
  • Validate whether a standard user can reach domain admin
  • Test tiering, PAW and credential-protection enforcement
  • Confirm alerting on privileged-group changes and mass admin logon
Business impact

The attacker controls the domain — every system and identity is now within reach.

ATT&CK techniques in this chain

T1078.002Valid Accounts: Domain AccountsT1003.001OS Credential Dumping: LSASS MemoryT1110.004Brute Force: Credential StuffingT1558.003Steal or Forge Kerberos Tickets: Kerberoasting

If this chain completes

Complete administrative control of the identity backbone, from which any system, mailbox or data store in the domain can be reached — the precondition for ransomware, mass data theft or long-term espionage.

Should you test this against your environment?

Turn this chain into a scoped red-team brief — objective, systems and identities in scope, testing assumptions and the questions to answer before commissioning.

Generate my red-team test briefExplore more paths