Cohesity Identity Resilience—Purpose-built for Active Directory challenges

In part one, we discussed how restoring Active Directory (AD) after a ransomware attack isn't as simple as restoring the latest backup—because that backup might already be compromised. Remember: 

• Blind restores can be dangerous. Restoring without validating means restoring the attacker's access alongside your data.
• Every hour of AD downtime paralyzes the entire organization. Kerberos-dependent systems—VPN, email, ERP, endpoint authentication—grind to a halt.
• Identity resilience requires purpose-built tooling. Generic backup solutions cannot ensure that AD is recovered without bringing back malware or compromised accounts. Cohesity Identity Resilience, combining automated, malware-free AD forest recovery and advanced threat detection and remediation, was built specifically for this problem.

The recovery paradox: Why traditional backups can fall short

When ransomware hits your identity infrastructure, the instinct is to restore from the latest snapshot. That's necessary but insufficient, and potentially dangerous if done blindly. 

The traditional restore trap

1. The compromise window is unknown. Attackers dwell inside environments for weeks, sometimes months before detonating. Restoring from last week's backup may bring back an AD already riddled with backdoors. How can you make sure your restore is clean and trusted?  

2. Backups likely contain the malicious modifications. DCShadow (T1207), SID History poisoning (T1178), AdminSDHolder ACL tampering (T1222.001): all of these changes replicate between domain controllers and are captured in backup snapshots. Restoring without inspecting means restoring the attacker's work alongside the legitimate data. 

3. Manual AD restoration is technically complex and unforgiving. An authoritative Active Directory restore requires booting into DSRM, navigating the differences between authoritative and non-authoritative recovery, managing replication across domain controllers. A procedural mistake under crisis conditions doesn't just delay recovery—it can actively worsen the situation. 

4. AD can be subject to a reinfection loop. If Active Directory is brought back online before the proper validation and forensics, servers still carrying the infection will reintroduce threats into the freshly restored directory within minutes.  

According to the Semperis 2025 Ransomware Risk Report, 84% of organizations experienced an identity-related breach in the past year. In the majority of successful ransomware attacks, Active Directory is the primary propagation vector.

Cohesity Identity Resilience: Purpose-built for challenges around identity attacks and recovery

Generic backup platforms were not designed to fill the gaps for withstanding, detecting, and recovering from identity-based attacks. Cohesity Identity Resilience, built from deep identity-specific expertise, addresses the full attack lifecycle: before, during, and after.

1. Proactive Active Directory hardening

The first pillar is continuous visibility and hardening. Cohesity Identity Resilience continuously scans on-premises and hybrid Active Directory environments, surfacing hundreds of Indicators of Exposure (IOEs) and Indicators of Compromise (IOCs).

The platform delivers:

• Risk scores per object, group, and domain.
• Attack path mapping to Tier 0 assets: Domain controllers, privileged accounts, critical objects.
• Prioritized remediation guidance with actionable steps.
• Service account monitoring: Detecting dormant, misconfigured, or overprivileged accounts.

2. Identity Threat Detection and Response (ITDR) in real time

Cohesity Identity Resilience includes advanced ITDR capabilities, designed to detect suspicious activity inside the directory including techniques that bypass native Windows audit logs, such as DCShadow (T1207).

Key capabilities:

• Tamperproof change tracking: Every AD modification is recorded immutably, even if event logs are disabled or cleared by the attacker.
• Automatic rollback: Malicious or risky identity changes can be reversed in real time without waiting for human intervention.
• Microsoft Entra ID monitoring: Near-real-time visibility into role assignments, group membership changes, and user attribute modifications across the hybrid identity landscape. This is important to prevent lateral movement from Entra ID to on-prem AD.

3. Validated recovery: The critical differentiator

This is where Cohesity Identity Resilience fundamentally breaks from traditional approaches.

Before any restore is executed, the platform can perform a security analysis of the candidate backup. It inspects the backup for known indicators of compromise: Skeleton Key artifacts (T1556.001), suspicious ACL modifications on AdminSDHolder (T1222.001), accounts with abnormal SID History (T1178), hidden objects (T1564.002), tampered critical GPOs (T1484.001), DCShadow traces (T1207).

Restoring a compromised AD is worse than not restoring at all. It gives the organization a false sense of recovery while keeping the attacker inside the perimeter.

Only after passing validation should a restore proceed. If IOCs are detected, the platform guides the IR team toward an earlier backup or targeted remediation steps, and, critically, it helps answer the question: at what point in time was the AD last known-clean? That date is the anchor for any secure recovery.

4. Fast forest recovery 

Every hour of AD downtime means a paralyzed organization: VPN down, email down, ERP inaccessible, workstations unable to authenticate. Every Kerberos-dependent system grinds to a halt.

Cohesity Identity Resilience enables:

• Active Directory forest recovery often in under an hour—versus days for a manual procedure
• Restoration onto clean bare metal or virtual hardware, with no requirement for a functioning domain controller as a starting point.
• Malware-free recovery with parallel multi-DC recoveries that are decoupled from the OS, which reduces the risk of re-introducing malicious code present in the compromised AD.

The procedure is guided, documented, and repeatable,, which means it can be tested regularly in pre-production. That last point is a fundamental shift: the AD cyber recovery plan should not be validated for the first time during an actual crisis.

5. Post-incident forensics and investigation

After an attack, Cohesity Identity Resilience accelerates the investigation by converting complex AD change data into plain language, enabling rapid forensic analysis at the object and attribute level. Teams can:

• Trace attacker activity through the directory with granular precision
• Identify and close remaining backdoors before bringing the environment back online
• Document the full attack timeline to meet legal and regulatory obligations (GDPR, NIS2, DORA)

6. Hybrid coverage: Extending to Microsoft Entra ID and Okta

Modern environments don't stop at the on-prem boundary. Cohesity Identity Resilience extends full protection to Microsoft Entra ID and Okta, safeguarding cloud identity objects and configurations including synchronized objects across AD and Entra ID hybrid environments, ensuring a consistent recovery posture regardless of where the identity lives.

What our Cyber Event Response Team sees 

The Cohesity CERT (Cyber Event Response Team) helps customers 24/7 in the event of a cyberattack. Tooling alone isn't enough if the fundamentals are missing. These are the most common mistakes observed during post-incident engagements on compromised AD environments. They aren't hypothetical. They are systematic.

The DSRM password is unknown or identical across all domain controllers.

Directory Services Restore Mode is the best way to operate on an offline domain controller during a crisis. Not knowing the password or discovering it hasn't been changed since the DC was provisioned years ago, stops recovery cold. This password must be documented, rotated regularly, and stored offline in a physical safe or an isolated secrets manager.

The identity cyber recovery plan has never been tested.

The procedure exists in a Word document somewhere. It has never been executed under realistic conditions. The result: the first real-world restore happens under maximum pressure, with an exhausted team, and it fails. An untested cyber recovery plan is not a cyber recovery plan. It's a liability dressed up as documentation.

NTLM is still enabled everywhere, and nobody knows why.

"We can't disable it, some application needs it." This sentence comes up in almost every incident response engagement. It is rarely verified. NTLM is a 1990s authentication protocol with no MFA support that directly exposes the environment to Pass-the-Hash (T1550.002). Its continued presence in a modern enterprise is a gift to attackers.

Service accounts have had 'temporary' Domain Admin rights for three years.

Overprivileged service accounts are among the most exploited escalation paths. They are rarely monitored, rarely audited, and their passwords are often static for years, making Kerberoasting (T1558.003) trivial.

AD audit logs are enabled, but nobody reads them.

Auditing is configured. Events are generated. They flow into a SIEM where no AD-specific correlation rules have been built. DCSync activity, AdminSDHolder modifications, Domain Admins group changes outside business hours: everything is logged, nothing is detected.

Identity is the blind spot of every recovery plan

Active Directory occupies a paradoxical and vertiginous position in enterprise security architecture. It is simultaneously the single point of failure that allows a ransomware attack to cascade across an entire organization in hours and the critical recovery dependency without which no business resumption is possible.

That duality isn't a technical nuance. It's a structural vulnerability. 

If AD is compromised, everything is compromised. Endpoints, servers, applications, identities, anything that authenticates through Kerberos falls under adversarial control. Deploying ransomware at that point is almost administrative: a few GPO pushes, a few minutes, and the entire estate tips.

If AD isn't restored cleanly, the attack isn't over. This is the trap too many organizations fall into: they restore their servers, bring applications back online, declare recovery, and the attacker is still there. Embedded in a Skeleton Key injected into LSASS. Hidden in a manipulated SID History attribute. Quietly sitting in a silently modified AdminSDHolder ACL. The incident is closed on paper. The breach continues in practice.

Cohesity Identity Resilience was built specifically against identity-based attacks as a cyber resilience platform that treats Active Directory for what it actually is: critical infrastructure, on par with a power grid or an industrial control system. Proactive hardening, real-time backdoor detection, immutable Identity backup, and validated recovery that helps guarantee the restored AD is clean, audited, and free of any persistent threat.

The question is no longer "Do you have a backup of your AD?" It’s now, “How long does it take you to restore Active Directory? And how certain are you that what comes back is clean? 

If the answer is hesitant, the attacker's next move won't be.

• Get a free, no-obligation identity security assessment with identity experts
• Learn more about Cohesity and Active Directory