Browsed by
Category: Uncategorized

LDAP Reconnaissance

LDAP Reconnaissance

When an attacker initially compromises a system on a network, they will have little to no privileges within the domain. However, due to the architecture of Active Directory, once an attacker has infiltrated any domain-joined computer, they are able to query the directory and its objects using LDAP, allowing them to locate sensitive accounts and assets to target in their attack.


Pass-the-Hash

Pass-the-Hash

Pass the Hash is a technique that enables an attacker (typically using Mimikatz) to leverage the LanMan or NTLM hashes of a user’s password – instead of the user’s plaintext password – to authenticate to a directory or resource.


Golden Ticket

Golden Ticket

By obtaining the password hash for the most powerful service account in Active Directory – the KRBTGT account – an attacker is able to compromise every account within Active Directory, giving them unlimited and virtually undetectable access to any system connected to AD.


DCShadow

DCShadow

DCShadow is a technique in which an attacker abuses compromised replication permissions to mimic a domain controller and make malicious changes to Active Directory. It is a particularly stealthy technique, as the methods it uses do not create logs that detail the changes made. Thus, it can be difficult to discover and remove the changes made by an adversary. Threat Summary Target: Active Directory Tools: mimikatz ATT&CK® Tactic: Defense Evasion ATT&CK Technique: T1207 Difficulty Detection: Medium Mitigation: Medium Response: Hard


AdminSDHolder Modification

AdminSDHolder Modification

Modifying the Access Control List (ACL) of the AdminSDHolder container in Active Directory enables an attacker to achieve and maintain persistence in an already compromised domain, even if an administrator finds and removes the attacker’s permission on a protected object the AdminSDHolder controls.


DCSync

DCSync

DCSync is a command within Mimikatz that an attacker can leverage to simulate the behavior of Domain Controller (DC). More simply, it allows the attacker to pretend to be a Domain Controller and ask other DC’s for user password data.


Plaintext Password Extraction

Plaintext Password Extraction

Threat (Privilege Escalation) Group Policy Preferences allow administrators to create and manage local accounts on servers and workstations in an Active Directory domain. Attackers can easily find and obtain the encrypted passwords of administrative account credentials managed by Group Policy Preferences and decrypt them using the Microsoft-published AES key. How Plaintext Password Extraction through Group Policy Preferences Works The following is a summarization of how the attack works: An attacker locates group policy XML files containing AES encrypted local account