[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4MDNDa1TCiB30iRP7JoAhi6x43kQGYfa6koJxmZHA9g":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"3a89ccd2-69a2-4e6e-86ee-d145959e150c","Anatomy of a Silent Domain Takeover","anatomy-of-a-silent-domain-takeover-1da801","Key Takeaways Modern AD attacks use legitimate protocols end-to-end, no malware, no exploit, nothing for signature tools to fingerprint. The evidence is already in the logs; what is missing is the narrative linking five benign-looking Windows events into a single attack. A full domain takeover can be completed in 54 minutes, from the first password […]","Modern Active Directory attacks are increasingly sophisticated, leveraging legitimate protocols and Windows events to achieve domain takeover within minutes without dropping malware or exploiting zero-days. These attacks are difficult for traditional signature-based tools to detect because each step appears normal, making it challenging for Security Operations Centers (SOCs) to connect scattered alerts into a coherent attack timeline. Posture management and real-time monitoring are crucial for identifying the underlying vulnerabilities and reconstructing the attack path.","Modern AD attacks bypass traditional security by using legitimate protocols, enabling domain takeover in 54 minutes.","https:\u002F\u002Fblog.qualys.com\u002Fproduct-tech\u002F2026\u002F09\u002F02\u002Fanatomy-of-a-silent-domain-takeover-ad-real-time-monitoring","https:\u002F\u002Fik.imagekit.io\u002Fqualys\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FBlog-Images-1080x1080.Cloud_.Agent_.2025.Updates-4-6.png","2026-09-02T15:00:00+00:00","2026-09-02T16:00:36.661587+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Active Directory","technology",{"name":21,"type":22},"Qualys AD Real-Time Monitoring","product",{"name":24,"type":22},"Qualys Enterprise TruRisk Management",{"name":26,"type":19},"Kerberos",{"name":28,"type":19},"DCSync",{"name":30,"type":31},"Microsoft","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[],[30,21,24],{"controls":58,"vendors":143},[59,88,114],{"slug":60,"name":61,"problem":62,"products":63},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":89,"name":90,"problem":91,"products":92},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[93,101,106],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":102,"product_name":103,"url":104,"description":105},"falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"slug":115,"name":116,"problem":117,"products":118},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"guardsix","Guardsix","\u002Fvendor-logos\u002Fguardsix.png","guardsix-siem","Guardsix SIEM","https:\u002F\u002Fguardsix.com\u002Fproduct\u002Fsiem","SIEM with automation, developed and hosted in Europe.",[144],{"slug":145,"name":146,"logo_path":147,"roles":148},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png",[149],"reported_by",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":168},"silent-active-directory-takeover-via-legitimate-protocols","Silent Active Directory Takeover via Legitimate Protocols","Attackers are achieving full Active Directory domain takeovers in minutes by abusing legitimate Windows protocols and built-in features, entirely without malware or zero-day exploits. Because each individual step mimics normal administrative activity, traditional signature-based detection tools fail to raise alarms, leaving SOC analysts with only scattered, low-priority alerts. This highlights a critical gap between perimeter-focused security models and the reality of identity-centric, living-off-the-land attacks. Without continuous posture management and behavioral monitoring of AD activity, organizations remain blind to the full attack chain until it is too late.",[155,156,157,158,159,160,161,162,163,164,165,166,167],"CIS Control 4: Controlled Use of Administrative Privileges","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 18: Penetration Testing","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 IA-5: Authenticator Management","MITRE ATT&CK TA0006: Credential Access","MITRE ATT&CK T1003: OS Credential Dumping","MITRE ATT&CK T1558: Steal or Forge Kerberos Tickets","MITRE ATT&CK T1484: Domain Policy Modification",{}]