Learn Active Directory - Active Directory Security Monitoring

#Introduction

In episode 22 you learned to fix problems that already happened. In episode 23 we change direction: from reactive to proactive. Active Directory is an attacker's primary target — almost every enterprise-grade attack flows back to AD, whether through Kerberoasting, golden tickets, or pass-the-hash. If you only realize you've been attacked after data leaks, it's already too late.

Monitoring comes down to one simple question: is anything different from usual? Answering it requires three things: rich logs (audit policy), centralized logs (forwarding), and a tool that can link events together (SIEM).

#Advanced Audit Policy

Most security logs don't appear by default. You must enable advanced audit policy via GPO: Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration. The subcategories that must be enabled on DCs:

• Account Logon and Logon/Logoff — for events 4624, 4625.
• Account Management — for events 4720, 4724, 4740.
• Kerberos Service Ticket Operations — for event 4769.
• Detailed File Share and Directory Service Access — for events 5140 and 4662.

Enable them across many DCs at once with auditpol:

auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable

Event IDs you must know on DCs:

#Windows Event Forwarding (WEF)

Audit logs that only live on DCs are useless if you have to log into each one to read them. Windows Event Forwarding streams logs from many DCs and servers to a single collector. Like CCTV centralized into one control room: without it, you'd have to watch every monitor yourself.

Set up a source-initiated subscription: source machines (forwarders) send logs to the collector. Enable the collector service:

wecutil qc
winrm quickconfig

On the collector, create a subscription via Event Viewer > Subscriptions, select Forwarded Events, and specify which events to send — start with a small subset like Security 4624, 4625, 4720, 4740, 4769, then expand.

#Sysmon

Default audit policy is still limited: no process or network connection detail. Sysmon (from Microsoft Sysinternals) adds deep telemetry, such as:

• Process creation with full command line and hashes.
• Inbound and outbound network connections per process.
• Driver and image loading.
• Access to specific files (e.g. lsass.exe).

Install with a validated configuration file:

Sysmon64.exe -accepteula -i sysmon-config.xml

#SIEM Integration

Centralized logs without analysis are just an archive. A SIEM connects events from many sources and triggers alerts when suspicious patterns appear:

• Microsoft Sentinel — cloud-native SIEM on Azure; ready-made analytic rules for AD, watchlists of critical accounts, and connectors to Defender for Identity.
• Wazuh — open source SIEM with active detection rules and built-in visualization.
• Grafana + Loki — an open source combination for flexible log visualization and querying.

Common AD SIEM rules: more than five failed logons on a single account within an hour, an admin account logging in from an unknown address, or a user added to the Domain Admins group outside working hours.

#Detecting Typical AD Attacks

Three attacks that most often hit AD and their signals:

• Kerberoasting — an attacker requests service tickets (TGS) for a service account with an SPN, then tries to crack them offline. Signal: a spike of event 4769 from one account toward many SPNs. Mitigation: use gMSA, long service account passwords, and monitor 4769.
• Golden Ticket — an attacker forges a TGT by stealing the krbtgt hash. Signal: tickets with suspicious lifetimes (above the default), or logons from unlikely accounts. Detectable by analyzing 4624 with ticket attributes.
• Pass-the-hash — an attacker uses an NTLM hash to log into other machines without the password. Signal: repeated type-3 (network) logons from one source to many machines, plus suspicious event 4776. Mitigation: disable unnecessary NTLM, apply Protected Users.

#Baseline and Alerting

Monitoring without a baseline is like recognizing an odd sound without knowing the normal one. Build a baseline: record logons per hour, the number of 4625s, admin login patterns, and tickets requested per day. Once the baseline exists, alerts are set against deviations:

• Threshold — e.g. "more than 10x the average number of 4625s within 24 hours".
• Anomaly — admin logon from a new location or device.
• Change alert — GPO changes, privileged group membership changes, or krbtgt password resets.

Start with a few high-quality alerts, not a hundred that always fire. Alerts numbed by too many false positives are as dangerous as having no alerts at all.

#Conclusion

In this episode you understand the AD security monitoring cycle:

• Advanced audit policy enables events 4624, 4625, 4720, 4740, 4769, and 4776.
• Windows Event Forwarding centralizes DC logs into a single collector.
• Sysmon adds process and network detail unavailable by default.
• SIEM tools like Microsoft Sentinel and Wazuh link events and trigger alerts.
• Kerberoasting, golden tickets, and pass-the-hash can be detected from event patterns.
• Baselines make alerts meaningful — deviation from normal, not just numbers.

A well-monitored system isn't one that's never attacked — it's one whose attacks are detected early, while damage can still be prevented. In episode 24, we polish the engine: Active Directory performance tuning — database optimization, LDAP queries, hardware, capacity planning, and building a performance baseline. See you there!