Active Directory Attacks Demystified: Pass-the-Hash (PtH), Pass-the-Ticket (PtT), and Beyond

This report outlines identity-centric threats in Active Directory, focusing on Pass-the-Hash and Pass-the-Ticket techniques, related privilege-escalation paths (e.g., WriteDACL, DCSync), common tools, impacts, and mitigation best practices (NTLM restriction, Kerberos hardening, least privilege, and monitoring). It uses lab-based walkthroughs to illustrate lateral movement and domain takeover, and explains how Qualys ETM Identity maps attack paths, detects toxic privileges, and monitors identity configurations to proactively reduce domain-compromise risk.