Active Directory provides centralized management of users, groups, computers and other network resources. It uses protocols like LDAP, DNS and Kerberos. Implementing Active Directory and conducting security audits like VAPT are important for the financial sector to manage access securely and identify vulnerabilities. The document discusses Active Directory components, protocols and attacks like Mimikatz and DCShadow. It also provides solutions like Azure ATP to detect attacks and recommends security best practices like access control policies and disabling unnecessary services.

1. ImplementingActive
Directory and Information
SecurityAudit alsoVAPT in
FinancialSector.
Prepared By:-
Kajol Patel :RSU1808023
Guided By : Dr. Priyanka Sharma

2. Introduction
 Digital world has opened unlimited avenues of opportunity by
enabling organizations to conduct business and share information
on a global basis. Active Directory Domain provides information
about network resource such as users, user’s password, groups,
authentication process, network printer and computer and makes
the information available to users and administration. Active
directory allows administrator to manage centrally all
management with the help of group policy.
 The presence of an information security audit increases the
probability of adopting major security measures and preventing
these attacks or lowering the cyber world attacks.
 VAPT includes auditing the system for finding vulnerabilities,
which may be exist on the system; exploit that vulnerability same
as an attacker perspective and produce data which representing
the system level risk.

3. Literature
Review
 In 2017, S. Sandhya1 et al, Sohini Purkayastha2 et al, Emil Joshua3
et al, Akash Deep4 et al discussing the utilizing the penetration
testing approach exploitationWireshark tool and demonstrating
that technique. It have additionally survived many tools for
penetration testing to unravel security aspects and problems.
 In 2016 year, Prashant S. Shinde1 et al, Shrikant B. Ardhapurkar2
et al explained clearly of various aspects and techniques employed
in vulnerability assessment and penetration testing. Additionally
concentrate area on cyber security threats awareness and
importance in organization, monetary sector to stay safe.They
conclude that there unit several tools obtainable forVAPT, with
new vulnerability evolution existing tools must be upgraded to
identify new vulnerabilities and makes them versatile and reliable
so new attack signature are often known.

4. Literature
Review
 In 2016, Subarna Shakya1Abhijit Gupta2 discussing the audit
aspects and challenges on system and Security Audit areas.
additionally they seeks clarification from the perceptive the
problems or behavior. group actionControls unit such techniques
and issues that addressing group action security and focus on risk
management and laptop security of the program at intervals the
monetary sector and organization.
 In 2015, P. C. R.V. Parmi1, discussing and implement the thought
of active directory in giant organizations may face to the loss of
management over user's resources and knowledge which may
lead to serious security threats. Directory which is ready to then
create the replication of all domain controllers within the domain.
However option to store the DNS info within the AD is not obtain
on DNS servers that is not a domain controller.

5. What isActive
Directory ?
 Active Directory is Microsoft's version of X.500 recommendations.
It 's database and directory service , which maintains the relations
ship between resources and enable them to work together. It
provide centralized repository for user account information and
directory authentication , authorization and assignment of right
and permissions.
 It store information in hierarchical tree like structure . It depends
on two Internet standard one is DNS and other is LDAP.
Information in Active directory can be queried by using LDAP
protocol and it use Kerberos for authentication.

6. Active
Directory
Fig 1: AD structure

7. Do the
Financial
Sector Need
Active
Directory
 Active directory is the most commonly used identity management
service in the world.
 95% of Fortune 1000 companies implement the service in their
networks.
 If I want to centrally manage access to resources such as printers,
users and group.
 If I want to control user accounts from one location.
 If I have application that rely on Active Directory.
 This concepts also used in financial sector and big organisations.

8. Active
Directory
Components
 Logical Structure
 Domains
 Organizational units
 Trees
 Forests
 Physical Structure
 Sites
 Domain controllers

9. Organizational
units
Fig 2: OU structure

10. Forests of
Trees
Fig 3:Trees structure

11. Protocols
 LDAP Protocol
 The requirement of protocols in active directory, First
methodology LDAP could be used by users to search and locate a
particular object like any system. LDAP makes use all keywords to
carry out a search operation.
 DNS Protocol
 Second methodology DNS that are domain controllers it will store
the data of the Active Directory which will then make the
replication of all domain controller of the particular domain.

12. Protocols
 Kerberos Mechanism
 Kerberos is an authentication method that allows users to log in to
an active directory domain. This authentication method provides
them with a token, which an identity server can be configured to
use as a contract.
 So for Kerberos protocol, it’s important to consider what role each
participant is authenticating with single particular authentication
transaction.
Fig 4: Kerberos process Fig 5: Kerberos process

13. Kerberos
implementation

14. Set
SPN(Service
Principal
Name)
 The Kerberos authentication service can use an SPN to
authenticate a service.

15. VAPT
Auditing
 Information Security Audit. Vulnerability Assessment and
Penetration Testing Services (VAPT) ABOUT VAPT. Vulnerability
Assessments are a process of identifying, quantifying, and.
vulnerabilities in a system.
 Steps:
 Executive Report – A high level overview of the activity
conducted, summary of issues identified, risk ratings and action
items.
 Technical Report – A detailed report explaining each issue
identified, step-by-step POCs for each issue, code and
configuration examples to fix the issue and reference links for
further details.
 Real-Time Online Dashboard – A online portal that allows your
teams to monitor the audit progress in real time, take immediate
actions for high risk issues, track fixes and closure status, etc.

16. Vulnerability
Analysis
 Service Account has Over-permission
 In service accounts has kind of account that always provides a lot
of privileges and allow services to the superjacent the actual
software package. This services running beneath service
incorporates a certificate in LSASS (Local security authority
subsystem) which might be steal and extracted by the attacker
and if the stealing credentials has admin rights then it’ll be simply
compromises the whole IT infrastructure.

17. DCshadow
attack onAD
 A DCShadow attack on AD and it is design for change the
directory using malicious replica of objects. During this attack,
DCShadow impersonating the Domain Controller using admin
rights and starts a replication process, so that changes made on
one DC are synchronizing with other DCs. DCShadow creates the
replication of directory Service Remote Protocol and AD Technical
specification.
 Mimikatz attack perform by the attacker. But it will destroyed
whole DC for the active directory.
 So In VAPT audit purpose we can not exploit this attack on the
domain. Only we have this attack as a vulnerability.

18. DCshadow
attack onAD
 An attacker obtains Domain Admin rights and wants to make
changes that will not be detected to create persistence.
 Using DCShadow (a feature of Mimikatz) the attacker will register
the computer it is run from (such as a workstation) as a Domain
Controller in Active Directory by making changes to the AD’s
Configuration schema and the workstation’s SPN values. Now AD
thinks this workstation is a Domain Controller and it is trusted to
replicate changes.
 A change is crafted by the attacker. The workstation makes this
change available to a legitimate Domain Controller through
replication.
 Replication is triggered by DCShadow and the change is replicated
and then committed by a legitimate Domain Controller

19. DCshadow
attack onAD
 Eternalblue_doublepulser
 EternalBlue Metasploit exploits a vulnerability in Microsoft’s
implementation of the Server Message Block (SMB) protocol. The
vulnerability exists because the SMB version 1 (SMBv1) server in
various versions of Microsoft Windows specially crafted packets
from remote attackers, allowing them to execute arbitrary code
on the target computer.
 This exploit is a combination of two tools “EternalBlue” which is
use as backdooring in windows and “DoublePulsar” which is used
for injecting dll file with the help of payload.

20. DCshadow
attack onAD Step 2: Get the shell
Step 1: Exploit with metasploit

21. Mimikatz
attacks
Step 3: load the mimikatz attack
Step 4: Perform mimikatz command
Step 5: Get the hashes

22. High-level
overview and
flowchart:  Mimikatz will execute the DCShadow attack as a three step
process: (1) it will set these SPN’s as part of the DCShadow
functionality, (2) it will temporarily host the necessary RPC
functions required by MS-DRSR process to serve the illegitimate
data for outbound replication, and (2) as a last step, Mimikatz will
force replication through the RPC Server.
Fig 6: Process of Attack

23. Solution
 AdvancedThreat Protection (ATP) to the rescue
 The successor to Microsoft ATA, Microsoft’s solution for protecting
your Active Directory, is now called Azure ATP. It does not rely on
events that get forwarded from your domain controller, but
instead uses its own sensors that your install on your DC. This
sensor does also capture events, but also looks at network traffic,
in memory processes and other new methods get added as
detections need them. This is why Azure ATP actually detects
(potential) DCShadow attacks.

24. Solution
Step 1: Shows the Attack

25. Solution
Step 2: Shows the user

26. Solution
Step 3: Shows the attack with severity

27. DNS
Configuration

28. CreateUsers
andGroup
Policies

29. Disabled windows
defender

30. Disabled windows
defender

31. Proxy
disabled
policy

32. Proxy
disabled
policy

33. Conclusion
 For existing system, in financial sector there would many
vulnerabilities occurred due to access privileges mechanism. So for
the best solution is to implement active directory environment
and performing information security audit and VAPT for financial
sector and it can provides the help from the inside and outside
cyber-attacks.

34. References
1) Implementation in anAdvanced Authentication Method Within
Microsoft Active Directory Network Services,by D. J. R. K. Jaroslav
Kadlec,
2) http://doece.pcampus.edu.np/index.php/prof-dr-subarna-shakya/
3) https://www.morganclaypool.com/doi/abs/10.2200/S00240ED1V01
Y200912DMK002
4) https://docs.microsoft.com/en-us/security-
updates/SecurityBulletinSummaries/2007/ms07-jul
5) https://www.researchgate.net/publication/335803762_Cyber_Defe
nce_A_Hybrid_Approach_for_Information_Gathering_and_Vulner
ability_Assessment_of_Web_Application_Cyberdrone
6) https://www.vutbr.cz/vav/projekty/detail/18799
7) http://icil.uniroma2.it/wp-content/uploads/2019/06/The-Support-
of-Strategy-Consulting-To-Italian-SMEs-In-Regaining-
Competitiveness-in-the-IT-Sector.docx
8) https://ieeexplore.ieee.org/document/8014711/?section=abstract
9) https://www.researchgate.net/publication/254004698_Mitigating_
Program_Security_Vulnerabilities_Approaches_and_Challenges