5 Active Directory Attack Paths Organizations Miss

Privileged groups accumulate members indirectly. A service desk group is added to a support group, which is added to a workstation admin group, which holds rights somewhere it should not.

The effective permission set is rarely what the org chart implies. Attack-path analysis reveals membership chains that no single administrator can see from the console.

Unconstrained and poorly scoped constrained delegation frequently survives migrations and consolidation projects. The system that needed it has often been decommissioned; the configuration remains.

Delegation misconfiguration converts a single compromised host into a route to privileged credentials.

AD Certificate Services is powerful, widely deployed and rarely reviewed with the same rigour as domain controllers. Template permissions that allow requesters to specify an arbitrary subject can enable authentication as another account.

Because the resulting authentication is legitimate by design, it is also difficult to detect without specific monitoring in place.

Privileged accounts used to log into ordinary workstations leave material behind. Once an attacker holds a foothold on that workstation, the tier separation intended to contain them no longer exists.

This is a process failure more than a technical one, which is why it survives tooling upgrades.

Service accounts often carry elevated rights, non-expiring passwords and configurations that make their credentials requestable by any authenticated user.

The combination is one of the most reliable privilege-escalation routes available inside a domain, and one of the cheapest to fix once identified.

Each of these paths produces observable activity. Whether it is observed depends on collecting the right telemetry and having detection content written for the specific technique.

That is the practical argument for combining assessment with monitoring: the assessment establishes which paths exist, and monitoring establishes whether anyone is walking them.