Anatomy of a Silent Domain Takeover

---

Key Takeaways

• Modern AD attacks use legitimate protocols end-to-end, no malware, no exploit, nothing for signature tools to fingerprint.
• The evidence is already in the logs; what is missing is the narrative linking five benign-looking Windows events into a single attack.
• A full domain takeover can be completed in 54 minutes, from the first password spray to the forged Golden Ticket, with each individual event appearing normal.
• Detection catches the move; posture management explains why it was possible and what to fix. Neither layer alone stops a modern identity attack.
• Qualys AD Real-Time Monitoring, the live detection engine inside Qualys Enterprise TruRisk Management (ETM) Identity, stamps every event with the identity, source Internet Protocol (IP), and Logon ID behind it, so one QQL pivot rebuilds the entire 54-minute path in a single view.

---

One password. Fifty-four minutes. Domain Admin. Every step used a legitimate protocol, so Active Directory (AD) Real-Time Monitoring stamps each alert with the identity behind it, and a QQL (Qualys Query Language) pivot rebuilds the entire path.

At 08:14, the attacker did not drop malware. They did not exploit a zero-day. They simply guessed one password that worked.

That is what makes modern Active Directory (AD) attacks so dangerous: every step appears to be normal Windows behavior. A failed login. A successful login. A Kerberos ticket request. A replication event. A service ticket with no obvious owner. Individually, each event can disappear into the noise. Together, they tell the story of a domain takeover.

The Rise of The Login-Based Breach

The attacker never had to be sophisticated, only patient enough to wait for a login prompt. That is why identity is now the battleground.

Verizon’s 2026 Data Breach Investigations Report (DBIR)analyzed over 31,000 incidents and 22,000 confirmed breaches: the human element was involved in 62% of all breaches, and credential abuse drove 13% of confirmed intrusions on its own. Vulnerability exploitation leads at 31%, but identity is the throughline behind more attacks than any single technique.

AD is where that identity pays off. Microsoft describes Active Directory Domain Services (AD DS) as the backbone of enterprise identity, which is exactly why it stays a favorite target. Compromise an identity, and you needn’t break anything else. The CISO’s question is no longer “will someone get a valid credential?” but “can we see what they do with it in time?”

Why Active Directory Attacks Evade Traditional Detection Tools

Ask any analyst what worries them and you get two words:volume and ambiguity. A single domain emits thousands of Event ID 4625 logon failures, and 4769 ticket requests a day, nearly all benign. And almost every serious AD attack is a legitimate feature turned malicious: a ticket request, a replication, an ACL edit. There is no binary to fingerprint and no clean line between attacker and noise.

Each event looks legitimate  on its own, which breaks the two tools most teams lean on:

• Signature tools (Antivirus/EDR) hunt for bad files. A DCSync produces no file. It’s two machines talking over the network using a protocol AD ships with, and nothing lands on the attacker’s disk. 
• Posture/scan tools photograph configuration on a schedule. They will flag a risky delegation by tomorrow, but not tell you that a forged ticket hit a file server ten seconds ago.

The evidence is almost always already in the logs. What is missing is the narrative that turns five legitimate-looking events into one attack. The SOC has the logs, but not the story. That is the gap AD Real-Time Monitoring closes.

54 Minutes Attack Story from First Login to Domain Admin

The target is corp.local, a mid-size enterprise running on-premises AD. The attacker wants Domain Admins. Five moves across 54 minutes get them there.

08:14 — The spray succeeds.  The attacker sprays one seasonal password Summer2024! across a LinkedIn-scraped username list, one attempt per account to dodge lockout. One answers: j.harris, a helpdesk analyst.

08:21 — Lateral movement.  A helpdesk session isn’t the prize. Using j.harris’s credentials, the attacker authenticates via Server Message Block (SMB) to WS-FIN01, a finance workstation that had never been touched before, seven minutes after the spray.

08:29 — Kerberoasting.  From that session, the attacker harvests service tickets for every account with a Service Principal Name (SPN) and cracks them offline. Service-account passwords are old and rarely rotated; svc-mssql (service account) falls to Sql$erver2020 (password).

09:02 — DCSync.  svc-mssql holds replication rights left over from a migration nobody cleaned up. The attacker abuses them to replicate the directory, including the krbtgt hash, the master key AD uses to sign every Kerberos ticket in the domain, as if they were domain controllers.

09:08 — Golden Ticket.  With the krbtgt hash, they forge a ticket-granting ticket offline for a fictitious corp\svc-backup, with Domain Admins baked inand injects it. The domain is now effectively  theirs.

Five moves, fifty-four minutes, and not one looked like an attack. The Event IDs behind them: 4625, 4624, 4769, 4662 are the same ones a healthy domain emits all day.

#	Time	Technique (MITRE)	Monitoring rule that fired	Event	QVSS / Posture
1	08:14	Password Spray (T1110.003)	Password_Spray_Detection + Spray_To_Successful_Logon	0→ 4624	9 – Weak min password length
2	08:21	Lateral Movement (T1021.002)	No alert – QQL pivot on Logon ID	4624	NA
3	08:29	Kerberoasting (T1558.003)	Kerberoasting_Sweep	4769 (Rivest Cipher 4)	10 – Stale service-account password
4	09:02	DCSync (T1003.006)	DC_Sync_Activity	4662	9.8 – AP_DCSync rights edge
5	09:08	Golden Ticket (T1558.001)	Golden_Ticket_Usage	4769 w/o 4768	10 – Stale krbtgt password

Table 1: Attack timeline with Monitoring detection rules and QVSS scores

What the SOC Analyst Sees in AD Real-Time Monitoring

Now run those 54 minutes through AD Real-Time Monitoring. It reads the same events, enriches them, and speaks in plain language, one named, scored alert per move:

08:14  →  “Spray to successful logon — j.harris breached.” Password_Spray_Detection (Medium) catches the spray pattern from a single source IP; Spray_To_Successful_Logon (Critical) then fuses the 4625 failures with the 4624 success from the same IP, confirming which account was compromised.

08:21  →  “Silent lateral hop — j.harris reaches finance workstation.”  One logon to a single host is normal, so the lateral rule fires only when there are five or more hosts. But the 4624 shares the spray Logon ID, so one pivot surfaces the hop and flags a non-privileged j.harris reaching finance.

08:29  →  “Kerberoasting sweep detected.”  Kerberoasting_Sweep (Critical) keys on five or more distinct SPNs requested with RC4 (type 0x17) from a single account in two minutes, the bulk pattern only an attacker produces.

09:02  →  “svc-mssql performed directory replication.”  DC_Sync_Activity (Medium) fires on replication rights (GUID 1131f6ad) exercised by a non-DC principal. The identity switches from j.harris to svc-mssql here.

09:08  →  “Forged or stolen Ticket-Granting Ticket (TGT) in use for svc-backup.”  Golden_Ticket_Usage (Medium) is absence-based: a 4769 request with no matching 4768 issuance inside the ticket-lifetime window.

Every alert tells the analyst who did it, what technique they used, and where in the attack it fits in plain English, not a raw Event ID 4769 to decode at 2 a.m.

Move From Scattered Alerts to a Single Attack Timeline

Connecting alerts like these is traditionally manual archaeology: logons from one source, tickets from another, replication from the DCs, joined by hand on timestamps and names.

In AD Real-Time Monitoring, there are two pivots. Every alert carries its identity and source IP. A pivot on the source IP forms the spine across the identity switches: j.harris to svc-mssql to svc-backup. A second pivot on the Logon ID adds the silent Stage 2 hop. The scattered events collapse into one timeline.

Alone, several events are unremarkable: a spray failure, one RC4 ticket, and a 4662. The sequence surfaced live in one view, making it an incident seen before the Golden Ticket is used at scale, not next week’s post-mortem.

Why The Takeover Was Possible?

A detection tells you an attack happened. Posture tells you why it could. Each stage rode a standing weakness, the Identity Misconfigurations had already surfaced before any rule fired:

None is exotic, a weak-policy domain, a crackable service account with leftover replication rights, and a stale krbtgt. A takeover waiting to be typed.

Stage	What the attacker exploited	The standing posture gap	Posture finding
Password Spray	j.harris had a weak, guessable password	Policy allowed passwords under 8 characters	Weak min password length
Kerberoasting	svc-mssql had an old, crackable password	Privileged, unrotated, RC4 allowed	Stale service-account password
DCSync	svc-mssql held replication rights it never needed	Non-DC principal with DS-Replication-Get-Changes-All	AP_DCSync rights edge
Golden Ticket	krbtgt hash forged a limitless ticket	krbtgt unrotated for 180+ days	Stale krbtgt password

Table 2: Posture gaps that enabled each attack stage

From Detection to Containment: Closing Every Door

AD Real-Time Monitoring detects the attack at event speed. Posture tells the responder which doors to weld shut. The response writes itself:

• Disable j.harris and force reauthentication for anything it touched.
• Reset the svc-mssql with a strong, managed password, ideally a Group Managed Service Account with Advanced Encryption Standard (AES) enforced.
• Revoke svc-mssql’s replication rights and audit who else holds DS-Replication permissions.
• Rotate krbtgt twice, 12–24 hours apart, to invalidate the forged Golden Ticket.
• Fix the password policy, raise the minimum length, and lockout thresholds.

Detection Tells You What Happened. Posture Tells You Why 

Qualys ETM Identity fuses AD Real-Time Monitoring with continuous posture management in a single platform. The real-time engine enriches Windows Security events as they arrive, decoding Security Identifiers (SIDs) into named, privilege-flagged identities and Globally Unique Identifiers (GUIDs) into human-readable rights, then alerts with the account, source IP, and Logon ID for each move. At the same time, the posture engine identifies the weaknesses that enable those attacks: stale krbtgt passwords, excessive replication rights, weak password policies, and crackable service accounts.

Detection catches the move. Posture explains why it worked.

The Identity Admin Workflow: Posture, Real-Time Detection, and Retrospective Hunting

SIEM and Extended Detection and Response (XDR) platforms process every event source and raise alerts for the SOC. ETM Identity processes the Identity Event log entries and Windows Security events from your Domain Controllers, and delivers the signal to the Identity Admin in the console they already run. One pane of glass, three views of the directory:

• Posture — the standing view.  Misconfigurations and stale credentials were scored and mapped to a fix.
• Real-time events — the live view. Identity-stamped alerts as the attack unfolds.
• Retrospective hunting — the rewind view. When a new IoC or TTP lands a fresh Kerberoasting SPN pattern, an attacker IP block pivots back through 7 days of raw events and 30 days of alerts to check if it’s already in your environment; no SIEM query, no SOC handoff.

Detection, posture, and hunting in one workflow, owned by the team that runs the directory.

What AD Real-Time Monitoring Does Differently

Four capabilities did the work in the story above, and they are the same four in every attack the product covers.

• Plain-English alerts. Every event is decoded before it becomes an alert. Cryptic SIDs become named users;, hex GUIDs become readable permissions. The analyst reads “a non-DC principal replicated the directory,” not a wall of hex.
• Identity on every alert. Each alert carries the user, source IP, and Logon ID. Two pivots collapse the entire attack into a single timeline, with no manual log joining. 
• Detection of what isn’t there. Some Kerberos attacks reveal themselves only by a missing event, a service ticket used without the login that should have come first. AD Real-Time Monitoring flags that absence; an attacker can’t fake it.
• Detection + posture on one platform. Real-time rules catch the move as it happens; posture management shows the standing weakness that made it possible. One tells you an attacker is inside; the other tells you what to fix, so the next one can’t repeat it.

Honest Blind Spots

No security tool sees everything. When our detection can’t reach a technique, we say so and name what else you need to catch it:

• Silver Tickets: A Silver Ticket is a forged access pass that the attacker hands straight to one specific server, a file share, a database, or a web app. Because the attacker never asks AD to issue the pass, no 4768 or 4769 event ever lands at the DC. To catch these, you need logs from the servers themselves, not just from the DC.
• Stealing the AD database offline: AD keeps its whole database in NTDS.dit, stored on every DC. . If an attacker copies that file from a backup, a VM snapshot, or a stolen DC, the theft happens on disk rather than on the live network, so no 4662 event ever fires. The defense is protecting backups and DC media, and adding host-level logging to catch the theft where it happens.

Detection Is the Last Mile. Prevention Is the First

Every posture gap in Table 2 is a standing exposure that the Qualys Risk Operations Center (ROC) classifies as an Indicator of Exposure (IoE). Underneath sits Enterprise TruRisk Management (ETM), which correlates identity risk with asset criticality across the enterprise and powers the ETM Identity detections in the story above.

Viewed as isolated findings, the four gaps read as four separate problems. Viewed through Identity TruRisk™ as an attack path, they resolve into one: j.harris → svc-mssql → svc-backup → Domain Admins. The analyst’s question evolves from “which alert should I investigate next?” to “which attack path can I neutralize before an adversary walks it?” Detection closes the last mile. Qualys ROC operates on the miles before it.

From Detection to Decision: What the CISO and SOC Need to Know

This intrusion was catchable the moment the password spray succeeded. It was containable by the time the Kerberoasting sweep began. It never had to reach the point where a forged Golden Ticket put Domain Admins in an attacker’s hands. 

Every domain runs an 08:14. The only question is whether your tooling turns that window into an alert or into hindsight.

---

Most domains carry the same quiet risks this one did: weak policies, old credentials, excessive privileges. See, what is sitting in yours?

---

Additional Resources

Password spray isn’t the only trick in the playbook. See how attackers weaponize Pass-the-Hash and Pass-the-Ticket, and how ETM Identity catches both before they escalate.

Contributors

• Tripura Kamble, Lead Engineer Threat Research, Qualys

Frequently Asked Questions (FAQs)

What is a silent domain takeover?

It is an Active Directory attack that uses only legitimate Windows protocols (password spraying, Kerberoasting, DCSync, Golden Ticket) so that each event appears to be normal activity. The attack becomes visible only when the sequence is reconstructed.

How long can a domain takeover take?

In the example shown, the full path from first successful password spray to a forged Golden Ticket was completed in 54 minutes.

Why do traditional tools miss these attacks?

Signature and EDR tools look for malware or exploits. Posture tools photograph configuration on a schedule. Modern AD attacks use legitimate protocols and leave no binary to fingerprint, so the evidence exists only as a sequence of normal-looking Windows events.

How does Qualys AD Real-Time Monitoring help?

It enriches Windows Security events in real time, stamps every alert with the identity, source IP, and Logon ID, and lets analysts rebuild the full attack path with one or two QQL pivots instead of manual log joining.

What is the difference between detection and posture in this context?

Detection tells you the attack is happening right now. Posture tells you why it was possible (weak password policy, stale service account passwords, excessive replication rights, unrotated krbtgt) and what to fix so that the next attempt fails.