Every attack on an Active Directory environment follows a predictable sequence. The techniques change, the tools change, the targets change — but the phases stay the same. And every phase leaves a specific footprint in the Windows Security Event Log.

Understanding this chain from the defender’s perspective means you know what to look for before an attacker even finishes. From the attacker’s perspective, knowing these logs exist means understanding what evidence you generate at every step.

The 7-Phase AD Attack Chain

1. Reconnaissance
The attacker maps the environment — finding users, computers, groups, and service accounts. Kerberos pre-authentication failures (EventCode 4771) appear here when the attacker guesses usernames that don’t exist.

2. Credential Attack
Password spray = one common password tried against every account (designed to stay under lockout thresholds). Pass-the-Hash = authenticating with a stolen hash directly. EventCodes 4625 (failed logon) and 4648 (explicit credential use) are the primary indicators.

3. Lateral Movement
With valid credentials, the attacker hops from system to system. A normal user doesn’t authenticate to 12 servers in 3 minutes. An attacker does. EventCode 4624 Type 3 (network logon) is the signature.

4. Privilege Escalation
The attacker elevates from regular user to administrator. EventCode 4672 (special privileges assigned at logon) fires every time a privileged account is used.

5. Persistence
The attacker plants a way back in — a backdoor account (EventCode 4720), a malicious service (EventCodes 4697 and 7045), or a scheduled task.

6. Credential Theft (Kerberoasting)
The attacker requests Kerberos service tickets for accounts with SPNs, then cracks the password offline. EventCode 4769 with Ticket_Encryption_Type = 0x17 (RC4) is the signature.

7. Full Domain Compromise (Golden Ticket)
The attacker obtains the krbtgt account hash and forges tickets that impersonate any user — including Domain Admin — for up to 10 years. Active Directory cannot distinguish a forged ticket from a real one.

📁 Free handout & resources: Download the Module 11 PDF — reference tables, Event ID cheat sheet, lab guides.

Learning Objective

After this lesson, you can name all 7 phases of an AD attack chain and identify the specific Event IDs associated with each phase.

Resource

The attack chain table on page 2 of the Module 11 handout maps every phase to its technique and the Event IDs to watch for. Download it from the Resources section of this course.

Part of the free Intro to Cyber course by Cover6 Solutions.