The Active Directory Attack & Defence Field Manual

A defender's field manual covering all 17 Active Directory compromise techniques catalogued by CISA, ASD and NSA, with the exact detection signal and mitigation for each, mapped to MITRE ATT&CK and organised by the attacker's kill chain.

• All 17 AD compromise techniques — from Kerberoasting to Golden SAML — grouped across 5 attack stages
• For each: how it works, the detection signal (with Windows Event IDs), and the mitigation that removes it
• A Windows event quick-reference for your SIEM/detection engineers
• The 7 high-leverage controls that close most of these paths at once