[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4MDNDa1TCiB30iRP7JoAhi6x43kQGYfa6koJxmZHA9g":3},{"article":4,"iocs":56},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":33,"category":34,"article_tags":38},"3a89ccd2-69a2-4e6e-86ee-d145959e150c","Anatomy of a Silent Domain Takeover","anatomy-of-a-silent-domain-takeover-1da801","Key Takeaways Modern AD attacks use legitimate protocols end-to-end, no malware, no exploit, nothing for signature tools to fingerprint. The evidence is already in the logs; what is missing is the narrative linking five benign-looking Windows events into a single attack. A full domain takeover can be completed in 54 minutes, from the first password […]","Modern Active Directory attacks are increasingly sophisticated, leveraging legitimate protocols and Windows events to achieve domain takeover within minutes without dropping malware or exploiting zero-days. These attacks are difficult for traditional signature-based tools to detect because each step appears normal, making it challenging for Security Operations Centers (SOCs) to connect scattered alerts into a coherent attack timeline. Posture management and real-time monitoring are crucial for identifying the underlying vulnerabilities and reconstructing the attack path.","Modern AD attacks bypass traditional security by using legitimate protocols, enabling domain takeover in 54 minutes.","Table of ContentsThe Rise of The Login-Based BreachWhy Active Directory Attacks Evade Traditional Detection Tools54 Minutes Attack Story from First Login to Domain AdminWhat the SOC Analyst Sees in AD Real-Time MonitoringMove From Scattered Alerts to a Single Attack TimelineWhy The Takeover Was Possible?From Detection to Containment: Closing Every DoorDetection Tells You What Happened. Posture Tells You WhyWhat AD Real-Time Monitoring Does DifferentlyHonest Blind SpotsDetection Is the Last Mile. Prevention Is the FirstFrom Detection to Decision: What the CISO and SOC Need to KnowContributorsFrequently Asked Questions (FAQs) Key Takeaways Modern AD attacks use legitimate protocols end-to-end, no malware, no exploit, nothing for signature tools to fingerprint. The evidence is already in the logs; what is missing is the narrative linking five benign-looking Windows events into a single attack. A full domain takeover can be completed in 54 minutes, from the first password spray to the forged Golden Ticket, with each individual event appearing normal. Detection catches the move; posture management explains why it was possible and what to fix. Neither layer alone stops a modern identity attack. Qualys AD Real-Time Monitoring, the live detection engine inside Qualys Enterprise TruRisk Management (ETM) Identity, stamps every event with the identity, source Internet Protocol (IP), and Logon ID behind it, so one QQL pivot rebuilds the entire 54-minute path in a single view. One password. Fifty-four minutes. Domain Admin. Every step used a legitimate protocol, so Active Directory (AD) Real-Time Monitoring stamps each alert with the identity behind it, and a QQL (Qualys Query Language) pivot rebuilds the entire path. At 08:14, the attacker did not drop malware. They did not exploit a zero-day. They simply guessed one password that worked. That is what makes modern Active Directory (AD) attacks so dangerous: every step appears to be normal Windows behavior. A failed login. A successful login. A Kerberos ticket request. A replication event. A service ticket with no obvious owner. Individually, each event can disappear into the noise. Together, they tell the story of a domain takeover. The Rise of The Login-Based Breach The attacker never had to be sophisticated, only patient enough to wait for a login prompt. That is why identity is now the battleground. Verizon’s 2026 Data Breach Investigations Report (DBIR)analyzed over 31,000 incidents and 22,000 confirmed breaches: the human element was involved in 62% of all breaches, and credential abuse drove 13% of confirmed intrusions on its own. Vulnerability exploitation leads at 31%, but identity is the throughline behind more attacks than any single technique. AD is where that identity pays off. Microsoft describes Active Directory Domain Services (AD DS) as the backbone of enterprise identity, which is exactly why it stays a favorite target. Compromise an identity, and you needn’t break anything else. The CISO’s question is no longer “will someone get a valid credential?” but “can we see what they do with it in time?” Why Active Directory Attacks Evade Traditional Detection Tools Ask any analyst what worries them and you get two words:volume and ambiguity. A single domain emits thousands of Event ID 4625 logon failures, and 4769 ticket requests a day, nearly all benign. And almost every serious AD attack is a legitimate feature turned malicious: a ticket request, a replication, an ACL edit. There is no binary to fingerprint and no clean line between attacker and noise. Each event looks legitimate on its own, which breaks the two tools most teams lean on: Signature tools (Antivirus\u002FEDR) hunt for bad files. A DCSync produces no file. It’s two machines talking over the network using a protocol AD ships with, and nothing lands on the attacker’s disk. Posture\u002Fscan tools photograph configuration on a schedule. They will flag a risky delegation by tomorrow, but not tell you that a forged ticket hit a file server ten seconds ago. The evidence is almost always already in the logs. What is missing is the narrative that turns five legitimate-looking events into one attack. The SOC has the logs, but not the story. That is the gap AD Real-Time Monitoring closes. 54 Minutes Attack Story from First Login to Domain Admin The target is corp.local, a mid-size enterprise running on-premises AD. The attacker wants Domain Admins. Five moves across 54 minutes get them there. 08:14 — The spray succeeds. The attacker sprays one seasonal password Summer2024! across a LinkedIn-scraped username list, one attempt per account to dodge lockout. One answers: j.harris, a helpdesk analyst. 08:21 — Lateral movement. A helpdesk session isn’t the prize. Using j.harris’s credentials, the attacker authenticates via Server Message Block (SMB) to WS-FIN01, a finance workstation that had never been touched before, seven minutes after the spray. 08:29 — Kerberoasting. From that session, the attacker harvests service tickets for every account with a Service Principal Name (SPN) and cracks them offline. Service-account passwords are old and rarely rotated; svc-mssql (service account) falls to Sql$erver2020 (password). 09:02 — DCSync. svc-mssql holds replication rights left over from a migration nobody cleaned up. The attacker abuses them to replicate the directory, including the krbtgt hash, the master key AD uses to sign every Kerberos ticket in the domain, as if they were domain controllers. 09:08 — Golden Ticket. With the krbtgt hash, they forge a ticket-granting ticket offline for a fictitious corp\\svc-backup, with Domain Admins baked inand injects it. The domain is now effectively theirs. Five moves, fifty-four minutes, and not one looked like an attack. The Event IDs behind them: 4625, 4624, 4769, 4662 are the same ones a healthy domain emits all day. #TimeTechnique (MITRE)Monitoring rule that firedEventQVSS \u002F Posture108:14Password Spray (T1110.003)Password_Spray_Detection + Spray_To_Successful_Logon0→ 46249 – Weak min password length208:21Lateral Movement (T1021.002)No alert – QQL pivot on Logon ID4624NA308:29Kerberoasting (T1558.003)Kerberoasting_Sweep4769 (Rivest Cipher 4)10 – Stale service-account password409:02DCSync (T1003.006)DC_Sync_Activity46629.8 – AP_DCSync rights edge509:08Golden Ticket (T1558.001)Golden_Ticket_Usage4769 w\u002Fo 476810 – Stale krbtgt password Table 1: Attack timeline with Monitoring detection rules and QVSS scores What the SOC Analyst Sees in AD Real-Time Monitoring Now run those 54 minutes through AD Real-Time Monitoring. It reads the same events, enriches them, and speaks in plain language, one named, scored alert per move: 08:14 → “Spray to successful logon — j.harris breached.” Password_Spray_Detection (Medium) catches the spray pattern from a single source IP; Spray_To_Successful_Logon (Critical) then fuses the 4625 failures with the 4624 success from the same IP, confirming which account was compromised. Figure 1: AD Monitoring Alerts view, showing rule alerts with severity, timestamp, host, and QQL search bar 08:21 → “Silent lateral hop — j.harris reaches finance workstation.” One logon to a single host is normal, so the lateral rule fires only when there are five or more hosts. But the 4624 shares the spray Logon ID, so one pivot surfaces the hop and flags a non-privileged j.harris reaching finance. 08:29 → “Kerberoasting sweep detected.” Kerberoasting_Sweep (Critical) keys on five or more distinct SPNs requested with RC4 (type 0x17) from a single account in two minutes, the bulk pattern only an attacker produces. 09:02 → “svc-mssql performed directory replication.” DC_Sync_Activity (Medium) fires on replication rights (GUID 1131f6ad) exercised by a non-DC principal. The identity switches from j.harris to svc-mssql here. 09:08 → “Forged or stolen Ticket-Granting Ticket (TGT) in use for svc-backup.” Golden_Ticket_Usage (Medium) is absence-based: a 4769 request with no matching 4768 issuance inside the ticket-lifetime win","https:\u002F\u002Fblog.qualys.com\u002Fproduct-tech\u002F2026\u002F09\u002F02\u002Fanatomy-of-a-silent-domain-takeover-ad-real-time-monitoring","https:\u002F\u002Fik.imagekit.io\u002Fqualys\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FBlog-Images-1080x1080.Cloud_.Agent_.2025.Updates-4-6.png","2026-09-02T15:00:00+00:00","2026-09-02T16:00:36.661587+00:00",8,[18,21,24,26,28,30],{"name":19,"type":20},"Active Directory","technology",{"name":22,"type":23},"Qualys AD Real-Time Monitoring","product",{"name":25,"type":23},"Qualys Enterprise TruRisk Management",{"name":27,"type":20},"Kerberos",{"name":29,"type":20},"DCSync",{"name":31,"type":32},"Microsoft","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":55},{"id":33,"icon":35,"name":36,"slug":37},[]]