Enumerating Active Directory: Lateral Movement and Privilege Escalation
•
0 likes•167 views
Attackers first gain access to an endpoint, then use enumeration tools to learn about the Active Directory environment and discover privileged accounts and configurations that can enable lateral movement and privilege escalation. They analyze the directory to find the easiest points of access, leveraging outdated, unknown, or improperly secured settings and delegations. Their goal is to spread ransomware or steal data with actions that may not log or can bypass logging.
Recommended
More Related Content
Similar to Enumerating Active Directory: Lateral Movement and Privilege Escalation
Similar to Enumerating Active Directory: Lateral Movement and Privilege Escalation (20)
More from Sylvain Cortes
More from Sylvain Cortes (8)
Recently uploaded
Recently uploaded (20)
Enumerating Active Directory: Lateral Movement and Privilege Escalation
- 1. © A L S I D C O P Y R I G H T 2 0 2 1 Enumerating Active Directory: Lateral Movement and Privilege Escalation Security Evangelist & Microsoft MVP
- 2. AtTACK structure © A L S I D C O P Y R I G H T 2 0 2 1 The attackers are looking for the easiest path into the network, then they want to move laterally and gain privileges. Once obtained, they can spread ransomware, steal data, and more. 1 2 3 4 5 6 Infect endpoint with phishing or e-mail attack, and gain local admin privileges Install payload, disable local defense, start to enumerate AD and the network topology Attempt to move laterally, to other endpoints, servers, and devices Exploit known configurations to gain privileges on different servers using AD Create backdoors and persistence within AD and other network devices Collect data and/or encrypt data - Steal data for economic intelligence Attack Steps
- 3. Enumeration tools © A L S I D C O P Y R I G H T 2 0 2 1 Bloodhound PowerView Ldapdomaindump Adidnsdump ACLight ADRecon Domains and trusts Domain SID Password Policy DCs Domain Users and attributes Domain computers Domain Groups and Members Shared folders Group Policies OUs ACLs Sessions Local Admin Rights … AdminTo MemberOf HasSession ForceChangePassword AddMembers CanRDP CanPSRemote ExecuteDCOM SQLAdmin AllowedToDelegate GetChangesAll GenericAll WriteDacl Owns … Sources: https://bloodhound.readthedocs.io/en/latest/data-analysis/nodes.html https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet#useful-enumeration-tools https://mcpmag.com/articles/2019/11/13/bloodhound-active-directory-domain-admin.aspx Tools Objects/settings Actions/privileges
- 4. Analyzing the enumeration © A L S I D C O P Y R I G H T 2 0 2 1 Leverage Unknown Settings - Kerberos Delegations - adminSDHolder - adminCount - SYSVOL permissions Leverage Cloud Settings - AAD Connect permissions - AAD Sync - AAD SSO - Bounce to Azure AD Leverage Old Settings - Service Principal Names - Primary Group ID - SIDHistory - AD Delegations - GP Delegations
- 5. ATTACKER strategy © A L S I D C O P Y R I G H T 2 0 2 1 Enumeration of Active Directory and all settings ▪ AD is « old » ▪ AD installation was made 10+ years ago ▪ AD is changing every day Analysis of AD to find easiest target ▪ Attackers don’t analyze the « world » with lines & columns but with graphs ▪ Remember, every user has a read access to AD Leverage actions which don’t log ▪ Security logs are not really useful ▪ Attackers can bypass the logs ▪ Attackers implement backdoors under the SIEM radar
- 6. In a nutshell © A L S I D C O P Y R I G H T 2 0 2 1 ▪ No users with local admin rights ▪ Encrypt local disk ▪ Use LAPS (free) ▪ Implement EDR ▪ Harden your endpoint configuration ▪ Do not base your security strategy only on logs ▪ Implement Microsoft Tier- model ▪ Detect in real- time AD security deviances & Attack paths ▪ Detect in real- time AD attacks Final advice: Doubt about yourself ! Too much self- confidence is the first enemy of cybersecurity…
- 7. © A L S I D C O P Y R I G H T 2 0 2 0 alsid.com you.