EtcSecBeta
Try freeSign InSign Up

Identity Security Blog

Expert insights on Active Directory and Azure security vulnerabilities, hardening guides, and remediation best practices.

123 articles
ANSSI Active Directory Guide: Applying the Security Recommendations in Practice
ADComplianceIdentity

ANSSI Active Directory Guide: Applying the Security Recommendations in Practice

This practical guide summarizes the ANSSI recommendations that matter most for Active Directory and shows how to turn them into concrete controls, logging, and hardening decisions.

Weak Certificate Mapping in AD CS: Why Strong Binding Matters
ADADCSKerberos

Weak Certificate Mapping in AD CS: Why Strong Binding Matters

Weak certificate mapping lets certificate-based authentication rely on reusable names instead of strong account bindings. Learn how it works, how to detect it, and how to harden AD CS.

Shadow Credentials: Abusing msDS-KeyCredentialLink in Active Directory
ADIdentityKerberos

Shadow Credentials: Abusing msDS-KeyCredentialLink in Active Directory

Shadow Credentials abuse msDS-KeyCredentialLink to create a key-based authentication path in Active Directory. Learn the mechanics, detection, remediation, and validation steps.

OAuth Consent Phishing: How Malicious Apps Bypass Password Theft
AzureIdentityApplications

OAuth Consent Phishing: How Malicious Apps Bypass Password Theft

OAuth consent phishing tricks users or admins into granting malicious apps access to Microsoft 365 data. Learn the mechanics, detections, remediation, and validation steps.

Device Code Phishing: How OAuth Device Flow Compromises Entra ID Accounts
AzureIdentityConditional Access

Device Code Phishing: How OAuth Device Flow Compromises Entra ID Accounts

Device code phishing abuses a legitimate OAuth flow to authorize attacker-controlled sessions. Learn how it works, how to detect it, and how to harden Entra ID.

Silver Ticket Attack: Forged Kerberos Service Tickets in Active Directory
ADKerberosAttack Paths

Silver Ticket Attack: Forged Kerberos Service Tickets in Active Directory

A Silver Ticket is a forged Kerberos service ticket created with a service account secret. Learn how the attack works, why it can avoid KDC visibility, and how to reduce the real prerequisites in Active Directory.

SMB Signing Disabled: Why It Still Enables NTLM Relay
ADNetworkMonitoring

SMB Signing Disabled: Why It Still Enables NTLM Relay

SMB signing disabled, or not required, still leaves Windows file traffic exposed to tampering and NTLM relay. Learn how the control works, how to verify it, and how to harden legacy SMB paths without guessing.

MFA Fatigue: Detection and Prevention for Microsoft Entra ID
AzureIdentityConditional Access

MFA Fatigue: Detection and Prevention for Microsoft Entra ID

MFA fatigue, or MFA bombing, abuses repeated push notifications to pressure users into approving a sign-in. Learn how it works in Microsoft Entra ID, how to detect it, and how to harden your tenant.

Password Spraying: Detection and Prevention for Active Directory and Entra ID
ADAzureAttack PathsPassword

Password Spraying: Detection and Prevention for Active Directory and Entra ID

Password spraying uses a small set of common passwords against many accounts to avoid lockouts and find weak identities. Learn how it works, how to detect it, and how to reduce exposure across AD and Entra ID.

Pass-the-Hash: How Stolen NTLM Hashes Still Lead to Lateral Movement
ADAttack PathsPassword

Pass-the-Hash: How Stolen NTLM Hashes Still Lead to Lateral Movement

Pass-the-Hash lets attackers authenticate with stolen NTLM material without knowing the cleartext password. Learn how it works, how to detect it, and how to reduce exposure in AD.

Windows LAPS Not Deployed: Why Shared Local Admin Passwords Still Matter
ADComputersGPO

Windows LAPS Not Deployed: Why Shared Local Admin Passwords Still Matter

Windows LAPS not deployed leaves local administrator passwords static or reused across endpoints. Learn how to detect the gap, deploy LAPS properly, and validate password rotation.

WDigest Enabled: Why Cleartext Credentials Reappear in LSASS
ADPasswordIdentity

WDigest Enabled: Why Cleartext Credentials Reappear in LSASS

WDigest enabled puts reusable credentials back into LSASS where attackers can harvest them after local compromise. Learn how it works, how to detect it, and how to turn it off safely.

Identity Security Resources

Explore the identity security pages that support this topic

Explore detailed pages for Active Directory, Entra ID, ETC Collector deployment, and side-by-side product comparisons.

Active Directory security audit

Review the landing page focused on Tier 0, Kerberos, delegation, ADCS, and remediation priorities.

Open page
Microsoft Entra ID security audit

See the Entra ID page covering Conditional Access, MFA, PIM, app permissions, and guest exposure.

Open page
PingCastle alternative

Compare PingCastle with ETC Collector for recurring AD audits and standalone collection workflows.

Open page
Purple Knight alternative

Compare Purple Knight with ETC Collector for AD plus Entra ID reviews and recurring follow-up.

Open page
ETC Collector

Review ETC Collector, its local deployment modes, and how teams run standalone or recurring audits.

Open page