Active Directory is still in the stack: detection and recovery options

Why does Active Directory need its own attention?

Active Directory relies on Kerberos and on replication between domain controllers, and attackers use both. Silverfort lists Pass-the-Hash, Pass-the-Ticket, Kerberoasting and DCSync among the attacks it detects, alongside password spraying and credential stuffing. These do not look like a failed cloud sign-in, so cloud identity protection alone does not see them.

What are the three approaches?

• Sensors on identity infrastructure: Microsoft Defender for Identity uses lightweight sensors and API connectors, covers on-premises AD, Entra ID and other IAM such as Okta, shows lateral movement paths, and reports incidents in the Defender portal.
• The replication stream: Semperis Directory Services Protector reads AD replication, watches hundreds of indicators of exposure and compromise across accounts, Group Policy, Kerberos, delegation and Entra ID, and can automatically roll back malicious changes.
• Inline at authentication: Silverfort responds before the authentication completes, with a block, an MFA challenge or a terminated session, and adds MFA to command-line tools and legacy systems that cannot take it natively.

Why is recovery a separate question?

Detection tells you something went wrong; recovery decides how long you are down. Semperis offers AD Forest Recovery, Disaster Recovery for Entra Tenant and Recovery for Okta. Ask any vendor, and your own team, how a full forest would be restored and when that was last rehearsed.

How do you see attack paths before an attacker does?

Semperis offers Forest Druid for Tier 0 attack paths, and Microsoft describes lateral movement paths and posture through Secure Score in Defender for Identity. Both answer the question of which accounts lead to domain control.

What about service accounts in AD?

Service accounts are often the weakest point: old, privileged and rarely reviewed. Silverfort describes behavioral baselines per service account and virtual fences that limit where each can sign in. This overlaps with the privileged access job.

Is there a free first step?

Semperis's Purple Knight is free. It assesses AD, Entra ID and Okta against 218+ indicators and produces a report card with remediation guidance. It is a baseline, not a detection product.

What should you ask?

• Which domain controllers and identity systems does the product watch, and what does it need installed?
• Which changes are rolled back automatically, and which only raise an alert?
• Is there a tested forest recovery plan, and who owns it?
• How are service accounts inventoried and limited?