1. Protecting the keys to the castle
– Restricted Admin Credential Exposure
Marcus Murray & Hasain Alshakarti
Truesec Security Team, MVP-Enterprise Security
x2

2. Marcus Murray Hasain Alshakarti

3. Who doesn’t want to be domain admin?

4. Passing the dutchie
Web Srv Mail Srv
DC File Srv
Client Client
Admin User

5. Mitigating Passing the dutchie
• SMB Signing! On domain controllers!

6. mimikatz
• privilege::debug
• inject::process lsass.exe sekurlsa.dll
• @getLogonPasswords
• Passwords in CLEAR TEXT!!!

7. The ”Mandiant report”

8. Local account depencencies
Web Srv Mail Srv
DC File Srv Mail Srv
SrvAdm SrvAdm
Client Client
CliAdm CliAdm

9. Logged on account depencencies
Web Srv Mail Srv
DC File Srv Mail Srv
Marcus_DA Marcus_DA
Client Client
Marcus_DA Marcus_DA

10. Complete mission
Web Srv Mail Srv
DC File Srv Mail Srv
Client Client
Admin User

11. Microsoft PtH Mitigations

12. Protecting!
• Local firewalls
• Non-admin
• Cutting dependencies
• Managed service accounts
• AMA

13. Marcus Murray Hasain Alshakarti

14. Thank you for listening! 