Microsoft Active Directory security: a deception-based approach

Active Directory is the identity backbone of most enterprise environments, and the most targeted component in advanced persistent threat (APT) campaigns. New and sophisticated attack variants appear continuously, and APTs constantly revise their strategy to find weaknesses in how enterprises implement AD. Standard security solutions detect and prevent a range of Active Directory attacks, yet they leave a gap against advanced threats that operate through AD’s own trusted mechanisms. Closing that gap calls for an integrated strategy that augments standard tools with deception, so that an attacker probing Active Directory reveals intent on first contact.

At a glance

• Standard AD tools (agent-based behavioral detection, event log monitoring, SIEM correlation) catch known signatures but strain against APTs operating through legitimate AD mechanisms such as valid credentials and authorized Kerberos requests.
• ShadowPlex seeds honey accounts and honeytokens directly into Active Directory, exposing attackers at the reconnaissance and credential-access stages.
• Deception playbooks cover the full AD attack taxonomy, including Kerberoasting, AS-REP Roasting, DCSync, DCShadow, Pass-the-Hash, and Golden and Silver Ticket attacks, aligned to MITRE Engage.
• Active Directory Insights gives defenders an as-the-attacker-sees-it, 100-plus-point view of AD misconfigurations and attack paths.
• ShadowPlex covers on-premises, Azure, and Hybrid AD. In the U.S. Navy ANTX FY25 exercise, deception delivered 100% true positive alerts and 80% denial of attacker objectives against automated, credential-driven techniques.

Most AD detection today rests on agent-based behavioral detection, AD event log monitoring, SIEM event correlation, SOC triage, and after-the-fact threat hunting. These methods are effective against known Active Directory attacks and recognized signatures. They are harder to apply against sophisticated APTs, because those actors conduct attacks through Active Directory’s own trusted mechanisms: valid credentials, authorized Kerberos requests, and legitimate replication traffic. When malicious activity is difficult to separate from normal administration, identity threat detection and response strains, and alert volumes climb as teams try to adjudicate ambiguous signals.

Protecting a component as central as Active Directory calls for an active defense strategy on top of those tools. MITRE Engage, the adversary engagement framework that replaced MITRE Shield in 2022, provides a knowledge base for planning deception and denial activities that expose and disrupt attackers as they act. Deception sits at the center of that approach, giving defenders a proactive way to detect Active Directory attacks that operate below the threshold of signature- and pattern-based detection.

The strongest way to protect Active Directory from attackers is a deception-based strategy that surfaces intent before an attacker reaches the domain controller. That strategy rests on five moves:

• Providing continuous visibility into potential attack surfaces.
• Ferreting out latent threats through threat investigation and advanced analytics.
• Predicting the attacker’s path and slowing their movement.
• Diverting the attacker while detecting the technique in use at every stage.
• Changing the attacker’s perception of the network.

ShadowPlex is an autonomous deception platform that operationalizes this for Active Directory. It uses a pre-built AD integration to auto-discover, tag, and analyze the entities registered in Active Directory, then registers deceptive entities at the correct level in the enterprise AD. That placement is what makes the approach scalable: rather than standing up complete fake AD forests, hiding real domain controllers on a network segment, or intercepting DNS lookups, which are the non-scalable approaches some deception tools take, ShadowPlex seeds Active Directory deception inside the real directory where an attacker actually looks. Hand-built, hand-fed decoys cannot keep pace with a directory that changes constantly, so automation is the entry requirement rather than a convenience. The result is a proactive posture that leads attackers toward deceptions and gives defenders more time to detect and respond, and it is delivered as an Active Directory Protection solution that augments the existing stack rather than replacing it.

ShadowPlex detects AD attacks with two families of deception: honey accounts and honeytokens. To an attacker, honey accounts look like real user and service accounts in AD, and honeytokens look like real account profiles on endpoints. Honey account examples include an IT or helpdesk administrator account and a SQL Server service account; honeytoken examples include account profiles seeded in the RDP cache and in LSASS memory. Because no legitimate process has any reason to touch these objects, the guiding principle is straightforward: why did anything touch an asset no legitimate process should need? The three mechanisms below show how that principle catches specific techniques.

Detecting Kerberoasting and AS-REP Roasting with honey service accounts

ShadowPlex deploys honey service accounts with Kerberoastable Service Principal Names (SPNs). No legitimate process requests service tickets for these deceptive accounts, so any Kerberos service-ticket request for one is a high-confidence signal of Kerberoasting. AS-REP Roasting detection works the same way: honey accounts configured without Kerberos pre-authentication required expose an attacker enumerating for roastable accounts on first contact, which makes Kerberoasting detection immediate rather than dependent on log correlation after the fact.

Detecting DCSync and DCShadow with deceptive domain controller artifacts

DCSync impersonates a domain controller to request credential replication, and DCShadow registers a rogue domain controller. Both require interaction with AD replication. ShadowPlex places deceptive replication artifacts and deceptive domain controller objects, so any replication request directed at one is a high-confidence signal of a DCSync or DCShadow attempt, without depending on a known signature to recognize the attack.

Detecting lateral movement with honeytokens in LSASS and RDP cache

Honeytoken account profiles seeded in LSASS memory and RDP credential caches expose attackers who dump credentials to move laterally. Pass-the-Hash, Pass-the-Ticket, and credential-stuffing attacks all read these stores, encounter the deceptive credentials, and reveal the intrusion the moment those credentials are used. This turns Active Directory lateral movement into a detection event, surfacing the attacker at the exact step where they expect to operate unseen.

Active Directory Insights answers a question every CISO eventually asks: what does my AD look like to an attacker? It provides an as-the-attacker-sees-it, 100-plus-point analysis of the AD attack surface, surfacing the weaknesses an APT would use for target selection, including:

• Misconfigurations across accounts, groups, and delegation.
• Privileged account exposure, such as shadow administrators and stale accounts with standing access.
• The potential attack paths that lead from an ordinary foothold toward the domain controller.

Defenders use that output to reduce the attack surface directly and to seed deceptions in the highest-risk AD locations, so the assets most likely to be targeted are also the ones most likely to expose an intruder. This view builds on the AD attack surface and AD attack paths covered earlier in this series, in Part 1 on the attack surface and Part 2 on attack paths.

ShadowPlex ships pre-packaged AD deception playbooks that encode deep knowledge of attacker TTPs, organized across the phases of an Active Directory attack. Mapped to MITRE ATT&CK tactics, the coverage spans:

• Initial access and reconnaissance: deep reconnaissance and AD enumeration.
• Privilege escalation: Domain Trust Abuse and delegation attacks.
• Credential abuse: Kerberoasting, AS-REP Roasting, Pass-the-Hash, Pass-the-Ticket, and credential replay.
• Post-exploitation: Golden Ticket, Silver Ticket, DCSync, and DCShadow.

Because each playbook activates without manual threat hunting, identity threat detection and response coverage extends across the full attack chain from first enumeration to late-stage domain compromise, and each phase becomes an opportunity to stop the attack in progress rather than reconstruct it afterward.