Active Directory Threat Modeling: Where Attackers Will Hit First (2026)

Last updated: April 26, 2026

Most defensive AD work happens reactively — a pentest report lands, findings get triaged, fixes get shipped. Threat modeling Active Directory means thinking the way attackers do before the pentest. This article walks through a structured threat-modeling exercise for AD: where attackers will hit first, why those vectors persist, and what a 90-day hardening sprint looks like in priority order.

Why threat-model AD specifically

Generic threat modeling treats infrastructure as an undifferentiated mass. Active Directory is different — it is identity infrastructure with deeply non-obvious privilege chains. STRIDE applied to “the AD domain” returns generic answers. STRIDE applied to “the path from any Domain User to Domain Admin” returns the specific misconfigurations your environment has accumulated over a decade.

The shift in mental model: AD is not a product. It is a graph of identities, rights, and trust relationships. Threat modeling it means walking the graph from attacker entry points to crown jewels and asking what stops each step.

The attacker’s entry points

Empirically, here is how Indian enterprise AD compromises start, ranked by frequency from our last 30 incident-response and pentest engagements:

1. Phishing leading to credential capture — 35-40%. Initial foothold: a user clicks, enters their AD password into a Microsoft 365 lookalike page, attacker authenticates as them.
2. Credential reuse from external breach — 20-25%. The user reused their corporate password on an external service that was breached. HaveIBeenPwned-style propagation.
3. Public-facing service with weak authentication — 10-15%. RDP exposed, Outlook Web Access without MFA, VPN with weak gateway authentication.
4. Vendor / supply-chain compromise — 8-10%. The MSP, the IT vendor, the SaaS provider has access; their compromise reaches you.
5. Insider — 5-8%. Disgruntled engineer, contractor with retained access.
6. Other — 5%. Watering-hole, USB drop, lost laptop with cached credentials.

Notice: in 60+% of cases, the attacker arrives with valid domain credentials. The question your AD threat model must answer is: given a valid Domain Users credential, how far can the attacker get?

The attacker’s typical playbook

From valid Domain User to Domain Admin, the empirical median path:

1. Run BloodHound. Understand the graph.
2. Look for Kerberoastable accounts with weak passwords. Get one cracked.
3. If the cracked account has any privilege escalation path (group membership, ACL right), exploit it.
4. If not, look for ADCS misconfigurations — ESC1, ESC8, etc.
5. If still stuck, look for shadow credentials, RBCD, or DACL-abuse paths in BloodHound.
6. Use any stepping-stone host to dump LSASS, harvest tokens, look for higher-privileged sessions.
7. Eventually obtain Domain Admin or equivalent (Enterprise Admin, schema admin, replication rights).
8. DCSync. Game over.

Median time from initial credential to DA equivalent in our engagements: 4 to 14 days for a careful red-team, 30 minutes to 2 hours for an aggressive one. The defenders are usually unaware throughout.

The threat model: STRIDE applied to AD privilege boundaries

Walk every trust boundary in your AD environment and apply STRIDE:

Boundary: Domain User → Authenticated

• Spoofing: Can someone authenticate without legitimate credentials? Phishing harvests, ASREP-roasting non-preauth accounts, NTLM relay attacks.
• Tampering: Can a non-domain machine join the domain? Default Domain Users can join 10 machines (ms-DS-MachineAccountQuota=10). Compromise a user, add a machine, leverage it.
• Elevation: Once authenticated, what rights does the account have by default? In default configurations, Authenticated Users can read most of AD, enumerate everyone, and run BloodHound. This is the foundation of every attack chain.

Boundary: Authenticated → Tier-2 Admin

• Elevation: Kerberoasting, password spraying, weak PAM, GPO abuse, write access on objects, ADCS templates, AS-REP roasting, computer accounts with delegation rights.
• Information disclosure: LAPS readable by non-admins, GMSA readable too broadly, password fields stored in description / comment / userInfo.

Boundary: Tier-2 → Tier-1 Admin

• Elevation: Service account in Domain Admins, custom group with WriteDACL on tier-1 objects, ADCS ESC4 on a privileged template, ACL paths via BloodHound.
• Lateral: Tier-2 admin sessions on hosts where Tier-1 admins also have sessions — credential pivoting.

Boundary: Tier-1 → Tier-0 (Domain Admin / DC)

• Elevation: Unconstrained delegation on a non-DC, RBCD on a DC’s computer object, GPO with edit rights linked to Domain Controllers OU, golden-certificate attacks, krbtgt-related issues.
• Information disclosure: NTDS.dit access, SYSTEM hive access, DCSync rights granted broadly.

Boundary: Tier-0 → Persistence

• Persistence: Golden Ticket, Silver Ticket, Skeleton Key, DCShadow, AdminSDHolder backdoor, krbtgt rotation skipped, certificate-based persistence (golden certificate).

Where most environments are weakest

Across the engagements:

• Tier-2 to Tier-1 boundary is the most-violated. Service accounts in Domain Admins is the typical pattern. Kerberoasting plus weak passwords give the attacker a free ride.
• ADCS misconfigurations are present in 70-80% of environments and provide a direct Domain User → Domain Admin shortcut, bypassing several layers of intended defence.
• Tier separation is not enforced. Tier-0 admins log into workstations. Tier-2 admins remote-desktop to DCs. The tiers exist on paper, not in policy.

Your 90-day hardening sprint, in priority order

Based on threat-modeling output, the actual remediation priority for an Indian mid-market AD environment in 2026:

Days 1-15: Visibility

• Run BloodHound against your own AD. Identify the top 20 privilege chains.
• Run Certipy. Identify ESC1-ESC16 vulnerable templates.
• Run Get-ADUser -Filter {servicePrincipalName -ne "$null"}. Identify Kerberoastable accounts.
• Audit current SIEM coverage against MITRE ATT&CK Lateral Movement and Credential Access tactics. Identify rule gaps.

Days 15-45: Quick wins

• Add all administrators to Protected Users group. (~2 hours of testing per cohort.)
• Disable ms-DS-MachineAccountQuota (set to 0). (~30 minutes; rare side effect.)
• Fix ADCS ESC1 templates: disable EnrolleeSuppliesSubject, require manager approval, or scope enrolment tightly. (~1 day per template.)
• Migrate top-five privileged service accounts to gMSA. (~2 days per account, mostly application-side testing.)
• Rotate krbtgt password twice (with delay between). (~1 hour, low-risk if done correctly.)
• Deploy LAPS to all domain-joined machines. (~1 week of rollout.)

Days 45-75: Structural

• Implement Authentication Policies binding Tier-0 admins to Privileged Access Workstations only.
• Enforce Credential Guard on all Windows 10/11 hosts.
• Deploy SIEM rules for: DCSync (Event 4662 with replication GUIDs), Kerberoasting bursts, Impacket PSExec patterns, LSASS memory access, AS-REP roasting.
• Fix unconstrained delegation on non-DC hosts. Either remove or convert to constrained delegation.
• Reduce broad-group memberships in privileged groups. Document why each member is there.

Days 75-90: Operationalise

• Tabletop exercise on a simulated AD compromise. Test the IRP end to end.
• Document tier-separation rules and roll out to admin community.
• Set up quarterly BloodHound + Certipy runs as a recurring control.
• Validate every SIEM rule with an actual attack simulation (Atomic Red Team, Caldera).
• Brief the board / audit committee with quantitative posture report — privilege chains found and closed, rules deployed, attack simulation pass rate.

How to think about ongoing AD security

Active Directory is the most consequential single piece of identity infrastructure in most enterprises. It accumulates entropy continuously — new users, new groups, new machines, new GPOs, new applications, all leaving rights and edges behind them. Threat modeling is not an annual workshop; it is a repeated exercise every quarter.

The question is always the same: given the current graph state, what is the shortest path from any compromised user to Domain Admin? The answer changes with every change ticket. Your job is to keep that path long enough that detection wins the race.

Compliance angle

• RBI Cyber Framework requires risk identification and a Cyber Crisis Management Plan — this exercise feeds both.
• SEBI CSCRF requires threat-led security testing for Q-RE and MII; an AD threat model with evidence of remediation is direct evidence.
• DPDP Act §8(5) reasonable security obligation — a defensible posture under DPB scrutiny includes proactive AD threat modeling.
• ISO 27001:2022 A.5.7, A.8.25-8.28 — operationalised through this kind of exercise.

The takeaway

Threat modeling Active Directory is the single most leveraged 90-day exercise an Indian enterprise IT/security team can run. Most environments find 2-3 unknown Domain Admin paths in week one. Closing them buys you measurable resilience against a real attacker. The work is mostly already known; the discipline is in actually doing it.