AD Technique → Compliance Control (Conceptual Mapping)

Disclaimer, read first. This is a conceptual, orientative mapping. It shows, at a high level, which family of controls an AD attack technique relates to, so a practitioner can point a finding in the right regulatory direction. It is not an auditor-defensible control matrix. A defensible mapping (one an auditor accepts, cross-referenced ID by ID to the exact control text, scoped to your organization's applicability statement, with evidence per control) is a curated product, not something you infer from a technique name. ADscan (free and source-available) produces that curated, ID-by-ID matrix as part of its report. Use this skill to orient a finding; do not present it to an auditor as compliance evidence.

How to read this

An AD technique succeeds because a control is weak or absent. Kerberoasting works because service-account authentication is weak and the requests are not monitored, so it relates to the authentication and logging control families. That relationship is conceptual: it tells a reader where in a framework to look, not that the finding satisfies or violates a specific control clause. The mapping direction is always technique → control family → representative article, and it stops there.

The frameworks, briefly

• ENS (Esquema Nacional de Seguridad, Spain): control families used here:
  • op.acc.1 Identificación
  • op.acc.4 Proceso de gestión de derechos de acceso
  • op.acc.5 Mecanismo de autenticación (usuarios externos)
  • op.acc.6 Mecanismo de autenticación (usuarios de la organización)
  • op.exp.2 Configuración de seguridad
  • op.exp.8 Registro de la actividad
  • op.exp.10 Protección de claves criptográficas
• NIS2 (Directive (EU) 2022/2555): Art.21(2) cybersecurity risk-management measures:
  • (g) basic cyber hygiene and training
  • (h) cryptography and encryption
  • (i) human resources security, access control policies, asset management
  • (j) multi-factor authentication, secured communications
• DORA (Regulation (EU) 2022/2554) with RTS (EU) 2024/1774 on ICT risk management:
  • Art.20: identity management
  • Art.21: access control (management of access rights)
  • Art.9 (DORA level-1, protection and prevention) is the parent duty the RTS details

The mapping

Kerberoasting / AS-REP roasting

Weak service-account or pre-auth-disabled credentials cracked offline. Touches authentication strength and activity logging (the ticket requests should be monitored).

• ENS: op.acc.5 / op.acc.6 (authentication mechanism), op.exp.8 (activity logging)
• NIS2: Art.21(2)(h) cryptography, Art.21(2)(i) access-control policy
• DORA: RTS Art.21 access control, Art.9 (protection/prevention parent)

DCSync

Replication of the credential database using directory-replication rights. Touches access-rights management (who holds Get-Changes) and logging.

• ENS: op.acc.4 (access-rights management), op.acc.1 (identification), op.exp.8 (logging)
• NIS2: Art.21(2)(i) access control, Art.21(2)(j) secured communications
• DORA: RTS Art.20 identity management, Art.21 access control

ACL abuse (GenericAll / WriteDACL / WriteOwner)

Excessive or misconfigured object permissions used to escalate. Touches access-rights management and secure configuration.

• ENS: op.acc.4 (access-rights management), op.exp.2 (security configuration)
• NIS2: Art.21(2)(i) access control and asset management
• DORA: RTS Art.21 access control

AD CS abuse (ESC1-ESC17)

Certificate-template and PKI misconfiguration leading to authentication as another principal. Touches cryptographic-key protection, secure configuration, and authentication.

• ENS: op.exp.10 (cryptographic-key protection), op.exp.2 (configuration), op.acc.5/op.acc.6
• NIS2: Art.21(2)(h) cryptography, Art.21(2)(i) access control
• DORA: RTS Art.21 access control, Art.9 (protection/prevention)

Kerberos delegation abuse (unconstrained / constrained / RBCD)

Delegation misconfiguration used to impersonate. Touches access-rights management and secure configuration.

• ENS: op.acc.4 (access-rights management), op.exp.2 (configuration)
• NIS2: Art.21(2)(i) access control
• DORA: RTS Art.21 access control

Coercion + NTLM relay

Forced authentication relayed to escalate; weak signing/channel-binding configuration. Touches secured communications and secure configuration.

• ENS: op.exp.2 (security configuration), op.acc.5/op.acc.6 (authentication)
• NIS2: Art.21(2)(j) secured communications, Art.21(2)(h) cryptography
• DORA: RTS Art.21 access control, Art.9 (protection/prevention)

Password spraying / weak-credential findings

Weak or reused passwords and missing MFA. Touches authentication and cyber hygiene.

• ENS: op.acc.5/op.acc.6 (authentication mechanism), op.acc.1 (identification)
• NIS2: Art.21(2)(j) MFA, Art.21(2)(g) cyber hygiene
• DORA: RTS Art.20 identity management, Art.21 access control

Credential exposure (GPP passwords, LDAP descriptions, shares)

Secrets left in SYSVOL, object attributes, or file shares. Touches cryptographic-key / secret protection and secure configuration.

• ENS: op.exp.10 (key protection), op.exp.2 (configuration), op.acc.4 (access-rights)
• NIS2: Art.21(2)(h) cryptography, Art.21(2)(i) asset management
• DORA: RTS Art.21 access control

Using this in a report

Attach one line of orientation to a finding, such as "relates to ENS op.acc.5 and NIS2 Art.21(2)(h)", so the reader knows the regulatory neighbourhood. Then stop. Do not stretch a conceptual relationship into a compliance verdict, do not claim the finding proves non-compliance with a specific clause, and do not present this as the control matrix an auditor signs off on. That curated, evidence-backed, ID-by-ID matrix is a separate, deliberate piece of work.