EtcSecBeta
Try freeSign InWaitlist

Identity Security Blog

Expert insights on Active Directory and Azure security vulnerabilities, hardening guides, and remediation best practices.

133 articles
NTLM Relay Attacks: Hijacking Authentication in AD
ADNetworkConfig

NTLM Relay Attacks: Hijacking Authentication in AD

NTLM relay lets attackers intercept authentication and impersonate users across the network without cracking passwords. Learn how the attack works and how to eliminate the exposure.

AD and Azure Compliance: NIS2, ISO 27001, CIS Controls
ADAzureComplianceConfig

AD and Azure Compliance: NIS2, ISO 27001, CIS Controls

NIS2, ISO 27001, CIS Controls — compliance requirements map to specific AD and Azure controls. Learn how to assess your environment and close compliance gaps efficiently.

Active Directory Monitoring: Security Event IDs That Matter
ADMonitoringConfig

Active Directory Monitoring: Security Event IDs That Matter

Most AD environments generate logs but lack the audit policy and detection logic to catch real attacks. Learn which events matter, how to configure them, and how to build effective SIEM detections.

Active Directory Trust Attacks: From Child Domain to Forest Root
ADTrustsAdvanced

Active Directory Trust Attacks: From Child Domain to Forest Root

Active Directory trust attacks abuse cross-domain authentication, SID filtering gaps, and forged Kerberos authorization data. Learn how trusts work, what to monitor, and how to reduce forest-level exposure.

Active Directory Attack Paths to Domain Admin
ADAttack PathsAdvanced

Active Directory Attack Paths to Domain Admin

Attack paths chain AD misconfigurations together to reach Domain Admin. Learn how BloodHound maps these paths and how to eliminate them before attackers exploit them.

Kerberos Delegation Attacks: From Unconstrained to RBCD Abuse
ADComputersKerberos

Kerberos Delegation Attacks: From Unconstrained to RBCD Abuse

Kerberos delegation attacks abuse legitimate delegation settings such as unconstrained delegation, constrained delegation, and RBCD. Learn the mechanics, detection logic, and safe remediation steps for AD environments.

Dangerous Group Nesting: Hidden Paths to Domain Admin
ADGroupsPermissions

Dangerous Group Nesting: Hidden Paths to Domain Admin

Dangerous group nesting creates hidden paths to Domain Admin through transitive group membership. Learn how to audit effective membership, monitor group changes, and remove unintended Tier 0 paths.

Stale Privileged Accounts: Hidden Risk in Active Directory
ADAccountsPrivileged Access

Stale Privileged Accounts: Hidden Risk in Active Directory

Forgotten accounts, ex-employee credentials, and over-privileged users are among the most exploited entry points in Active Directory. Learn how to find and eliminate them.

ADCS Attack Paths Explained: How Certificate Misconfigurations Become Active Directory Escalation Paths
ADADCSAttack Paths

ADCS Attack Paths Explained: How Certificate Misconfigurations Become Active Directory Escalation Paths

A technical guide to ADCS attack paths: vulnerable templates, template ACL abuse, CA-wide SAN abuse, relayable enrollment endpoints, and validation after remediation.

Active Directory Password Security: Misconfigurations That Matter
ADPasswordAccounts

Active Directory Password Security: Misconfigurations That Matter

Weak password policies, non-expiring passwords, and cleartext credential storage are among the most exploited misconfigurations in Active Directory. Learn how to find and fix them.

AS-REP Roasting: Harvesting Hashes Without Credentials
ADKerberosAttack Paths

AS-REP Roasting: Harvesting Hashes Without Credentials

AS-REP Roasting targets accounts with Kerberos pre-authentication disabled, allowing attackers to collect crackable hashes with zero credentials. Learn how to detect and fix it.

Kerberoasting Detection Prevention Guide: How to Find and Protect Crackable Service Accounts
ADKerberosAttack Paths

Kerberoasting Detection Prevention Guide: How to Find and Protect Crackable Service Accounts

A technical guide to Kerberoasting detection and prevention in Active Directory, covering SPN exposure, TGS telemetry, RC4 reduction, service account hardening, and validation.

Identity Security Resources

Explore the identity security pages that support this topic

Explore detailed pages for Active Directory, Entra ID, ETC Collector deployment, and side-by-side product comparisons.

Active Directory security audit

Review the landing page focused on Tier 0, Kerberos, delegation, ADCS, and remediation priorities.

Open page
Microsoft Entra ID security audit

See the Entra ID page covering Conditional Access, MFA, PIM, app permissions, and guest exposure.

Open page
PingCastle alternative

Compare PingCastle with ETC Collector for recurring AD audits and standalone collection workflows.

Open page
Purple Knight alternative

Compare Purple Knight with ETC Collector for AD plus Entra ID reviews and recurring follow-up.

Open page
ETC Collector

Review ETC Collector, its local deployment modes, and how teams run standalone or recurring audits.

Open page