Active Directory sits at the center of most enterprise networks, which makes it both the attacker’s favorite target and the defender’s most valuable sensor. The uncomfortable truth: many common AD detections are trivially bypassed, not because attackers are brilliant, but because the detections were built on incomplete telemetry.
Common bypass patterns
Blending into normal directory noise. LDAP reconnaissance with paged, low-volume queries looks like any application. Detections keyed on query volume miss patient attackers entirely.
Kerberos abuse below the alert threshold. Kerberoasting a handful of service accounts with RC4 downgrade generates 4769 events, but so does the whole enterprise, constantly. Rules that only flag bulk requests miss the targeted ask.
DCSync from “legitimate” contexts. Directory replication (DRSUAPI) from a compromised account that already holds replication rights produces the same 4662 events as a real domain controller sync. If your rule only checks for the access mask, membership context is the missing dimension.
NTLM relay instead of cracking. Why brute-force a password (noisy 4625s) when coerced authentication and relay produce only successful logons?
Closing the gaps
| Blind spot | Fix |
|---|---|
| LDAP recon | Enable LDAP query logging (Field Engineering diagnostics), baseline per-source query patterns |
| Kerberoasting | Alert on RC4 (0x17) ticket encryption for service accounts; honey-SPN accounts that should never be requested |
| DCSync | Alert on 4662 with replication GUIDs from any account that is not a DC computer account |
| NTLM relay | Enforce SMB/LDAP signing and channel binding; monitor for authentication from unexpected hosts |
The larger lesson
Every bypass in this list exploits a gap between what the detection assumes and what the telemetry actually shows. Hunting for your own blind spots, running the technique in a lab and watching what your SIEM sees, is the most honest detection review a team can do.
This article was originally published on Medium.