CISA's 17 Active Directory Attack Techniques: Detection and Defense with Sophos MDR
Sophos, Wednesday, October 7th, 2026
Sophos groups CISA's 17 Active Directory compromise techniques into four categories and explains how to defend against them with MDR.
Sophos MDR incident response lead Anthony Bradshaw groups the 17 Active Directory compromise techniques identified by CISA and its partners into four categories.
These are credential access such as Kerberoasting, privilege escalation and lateral movement such as DCSync, certificate and authentication abuse such as AD CS compromise and Golden Tickets, and persistence such as Golden SAML.
Citing Sophos data that attackers first try to breach AD within a median of 11 hours, he argues AI compresses attack timelines rather than inventing techniques, and covers the identity controls, telemetry and MDR and ITDR response that stop abuse before admin privileges are reached.