Common Active Directory attacks

Attack	Core idea	Look for
Password spray	Few passwords against many accounts	Many 4625s/users, same source, low attempts per user
Brute force	Many attempts against one/few accounts	Repeated 4625, eventual 4624, source history
Pass-the-Hash	Stolen NTLM hash used without plaintext	NTLM, 4624/4648/4776, unusual lateral movement
Pass-the-Ticket	Stolen Kerberos ticket reused	Ticket/account inconsistencies, service access, lateral movement
Kerberoasting	Request SPN tickets for offline cracking	4769 volume, requester, many SPNs, meaningful legacy encryption
AS-REP roasting	Target users without Kerberos pre-auth	4768 and account configuration
DCSync	Replication requested by non-DC identity	Replication rights/activity, privileged account/source
Golden Ticket	Forged TGT using KRBTGT material	Impossible/anomalous ticket and privileged-access properties
Silver Ticket	Forged service ticket using service key	Service-side anomalies; DC evidence may be limited
LDAP enumeration	Broad directory discovery	Users/groups/computers/SPNs queried at unusual volume
RDP movement	Remote interactive access	4624 type 10, unusual source/user/host pairing
SMB/service execution	Remote file/service execution	Admin shares, SMB writes, 4697/7045, child processes

Correlation

These are investigation patterns, not single-event signatures. Validate expected administration, collection coverage, and account/service context.