CISA and five international cybersecurity agencies published technical guidance documenting 17 techniques hackers use to compromise Microsoft Active Directory environments, exploiting identity configurations, legacy protocols, and certificate services to escalate privileges and establish persistence in enterprise networks.