Active Directory Under Siege: A CISO's Guide to Defending Critical Infrastructure from Credential Dumping

Active Directory Under Siege: A CISO's Guide to Defending Critical Infrastructure from Credential Dumping

TL;DR: Executive Summary

• The Threat: State-sponsored actors, notably Volt Typhoon, are actively targeting Australian critical infrastructure by exploiting identity systems, not just deploying malware. Their primary technique is credential dumping from Active Directory (AD).
• The Mechanism: Attackers gain an initial foothold and then extract password hashes and Kerberos tickets from memory (LSASS) or the AD database (NTDS.dit) to impersonate legitimate users.
• The Impact: A single compromised high-privilege account provides attackers with the 'keys to the kingdom', enabling undetectable lateral movement, data exfiltration, and operational disruption.
• The Mandate: For organisations governed by Australia's SOCI Act, reliance on traditional perimeter defence is insufficient. The principles of Zero Trust are becoming a de facto standard for demonstrating cyber resilience and meeting compliance obligations.

The New Battlefield: Why Identity is the Perimeter for Critical Infrastructure

Recent advisories from the Australian Cyber Security Centre (ACSC) and international partners have highlighted a significant strategic shift by sophisticated threat actors like Volt Typhoon. These groups are targeting Australia's critical infrastructure sectors—energy, water, communications, and transport—with a focus on stealth and persistence. Their methodology avoids noisy malware, opting instead for a more insidious approach: the exploitation of identity and access management systems. By leveraging 'living-off-the-land' techniques and stolen credentials, they blend in with normal network traffic, making detection exceptionally difficult.

For a Chief Information Security Officer (CISO), this represents a fundamental challenge that must be communicated to the board. The risk is no longer just about preventing a breach at the firewall; it's about assuming the adversary is already inside and controlling the one asset that grants them legitimacy: user identity. At the heart of this identity infrastructure in most organisations lies Microsoft Active Directory.

What is Credential Dumping and How Does it Work?

Credential dumping is the process of obtaining account login and password information, typically in the form of hashes or clear-text credentials, from a system's memory or storage. In an AD environment, this gives an attacker the raw materials to escalate privileges and move laterally across the network. The primary targets are the Local Security Authority Subsystem Service (LSASS) process and the Active Directory database file (NTDS.dit).

Anatomy of a Credential Dumping Attack

🔐

1. Initial Access: Attacker gains a foothold on a single endpoint via phishing, exploit, or misconfiguration.

↓

🔍

2. Local Discovery: Attacker enumerates the local system to identify security processes and potential privilege escalation paths.

↓

💻

3. LSASS Memory Dump: Using tools like Mimikatz or even built-in Windows utilities (e.g., Task Manager), the attacker dumps the memory of the LSASS.exe process, which stores credentials of logged-on users.

↓

📋

4. Credential Extraction: The memory dump is analysed offline to extract NTLM hashes, Kerberos tickets, and sometimes clear-text passwords.

↓

🚶

5. Lateral Movement: Attacker uses the extracted credentials in Pass-the-Hash or Pass-the-Ticket attacks to authenticate to other systems as a legitimate user.

A common command an attacker might use with an embedded tool like Mimikatz is deceptively simple:

privilege::debug
sekurlsa::logonpasswords

This single command attempts to elevate privileges and then dump all available credentials from the LSASS process in clear text, demonstrating the low execution barrier for a high-impact attack once a foothold is established.

Why Active Directory is a High-Value Target

Active Directory is the central nervous system of most enterprise networks. It manages identity, authentication, and authorisation for users, computers, and services. For an attacker, compromising AD is the ultimate goal, as it provides a pathway to total network dominance. The table below outlines common AD weaknesses exploited by threat actors.

AD Weakness	Attacker Exploitation Method	Business Impact for Critical Infrastructure
Weak Password Policies	Offline password cracking of dumped NTLM hashes.	Rapid privilege escalation to sensitive operational technology (OT) control accounts.
Stale or Orphaned Accounts	Use of dormant admin accounts that are not monitored.	Persistent, low-and-slow access that bypasses typical user behaviour analytics.
Excessive Privileges	Compromise of a standard user account that is part of an over-privileged group.	Reduces the number of steps required for lateral movement to critical systems.
Unconstrained Delegation (Kerberos)	Kerberoasting attacks to extract service account password hashes.	Compromise of critical application and database service accounts, leading to data manipulation or destruction.

From Dump to Dominance: Visualising Post-Exploitation

Once credentials are dumped, attackers don't stop. They use this access to move laterally and escalate privileges until they control a Domain Admin account. The data shows a clear pattern in the techniques used following a successful credential dump.

The Zero Trust Mandate: Beyond Compliance to Operational Necessity

For CISOs of organisations falling under the Security of Critical Infrastructure (SOCI) Act 2018, the threat of identity-based attacks has direct legal and regulatory implications. The Act's positive security obligation requires entities to take all reasonable steps to mitigate risks. In the context of threats like Volt Typhoon, a traditional perimeter-based defence is no longer 'reasonable'.

Zero Trust architecture provides a defensible and operationally sound framework. It operates on the principle of "never trust, always verify," shifting defence from static, network-based perimeters to a focus on users, assets, and resources. Key principles that directly counter credential dumping include:

• Explicit Verification: Authenticate and authorise based on all available data points, including user identity, location, device health, service, and data classification.
• Least Privilege Access: Limit user access with just-in-time and just-enough-access (JIT/JEA) policies to minimise the impact of a compromised account.
• Assume Breach: Segment networks, encrypt all communications, and use analytics to gain visibility, detect threats, and improve defences.

Presenting a Zero Trust roadmap to the board is no longer a conversation about theoretical best practice; it's a direct response to documented threats from sophisticated actors and a core component of meeting SOCI Act obligations.

Actionable Defence: What CISOs Should Do Now

Mitigating these threats requires a multi-faceted strategy focused on hardening Active Directory and adopting a modern security posture.

1. Harden Endpoints: Implement Credential Guard on Windows 10/11 Enterprise to isolate the LSASS process and prevent direct memory access.
2. Implement Tiered Administration: Enforce a model where administrative accounts for high-value assets (like Domain Controllers) cannot log into lower-trust systems (like user workstations), preventing credential theft.
3. Deploy Advanced Threat Analytics: Utilise solutions like Microsoft Defender for Identity to analyse AD traffic in real-time and detect anomalies indicative of Pass-the-Hash or other identity-based attacks.
4. Accelerate Zero Trust Adoption: Prioritise the implementation of multi-factor authentication (MFA) everywhere, network micro-segmentation, and privileged access management (PAM) solutions.

The path to resilience begins with a deep, objective understanding of your current Active Directory security posture. It's imperative to identify and remediate the latent vulnerabilities that actors like Volt Typhoon are built to exploit.

At Lean Security, we specialise in providing penetration testing and advisory services that simulate these advanced attack paths. We help Australian critical infrastructure organisations identify identity-based weaknesses and build a defensible roadmap towards a Zero Trust architecture. Discover how our targeted assessments can strengthen your defences at www.leansecurity.com.au.

Frequently Asked Questions (FAQ)

What is the SOCI Act?

The Security of Critical Infrastructure (SOCI) Act 2018 is an Australian Government legislative framework designed to manage the risks to essential services. It imposes obligations on owners and operators of critical infrastructure assets, including the requirement to report cybersecurity incidents and maintain a risk management programme.

Is Multi-Factor Authentication (MFA) enough to stop credential dumping?

MFA is a critical control for preventing initial access but does not stop credential dumping once an attacker has a foothold on a device. An attacker on a compromised machine can still dump credentials from memory of users who have already authenticated. This is why defence-in-depth, including endpoint hardening and least privilege, is essential.

How is a Pass-the-Hash attack different from a normal login?

In a normal login, you provide a password, the system hashes it, and compares it to the stored hash. In a Pass-the-Hash (PtH) attack, the attacker steals the already-hashed version of the password and presents that directly to the authentication system (like NTLM), bypassing the need to ever know the clear-text password.