Chapter 71 — Endpoint, Active Directory, Entra ID, and EDR realities
In one sentence
Enterprise compromise usually becomes an identity-and-endpoint problem: steal a credential, execute somewhere, move laterally, escalate, persist, and evade or overwhelm detection.
The core attack path
phished user
-> endpoint execution
-> token / credential theft
-> lateral movement
-> directory privilege escalation
-> cloud control-plane access
-> data exfiltration / ransomware / persistence
This is why endpoint, directory, and cloud identity cannot be treated as separate programs.
AD and Entra ID review checklist
| Area | Questions |
|---|---|
| Privileged groups | Who is Domain Admin / Global Admin / Privileged Role Admin, and why? |
| Tiering | Can workstation admins reach servers or domain controllers? |
| Service accounts | Are passwords long, rotated, gMSA/managed where possible? |
| Kerberos | Any Kerberoastable high-privilege service accounts? |
| MFA | Is MFA phishing-resistant for admins and sensitive apps? |
| Conditional access | Are legacy protocols and unmanaged devices blocked? |
| Device trust | Are EDR/MDM signals used carefully, with break-glass paths? |
| Logging | Are sign-in, audit, endpoint, and directory changes correlated? |
EDR reality
EDR is a sensor and response tool, not a magic shield. It can:
- record process, file, network, registry, module, and script telemetry;
- block known bad behavior;
- isolate hosts;
- accelerate triage.
It cannot compensate for:
- users with standing admin everywhere;
- unpatched internet-facing systems;
- no MFA on privileged access;
- excluded paths where malware runs freely;
- missing identity logs.
Real-world scenario: helpdesk to domain compromise
- Attacker phishes helpdesk credentials.
- Helpdesk can reset passwords for most users.
- A stale group gives helpdesk reset rights over a service account.
- Service account has local admin on servers.
- One server has cached privileged credentials.
No single step looked catastrophic. The attack path was catastrophic. The fix is path-breaking: privileged access tiering, scoped reset rights, admin workstation model, service-account hygiene, and alerts on sensitive group/role changes.