Active Directory Attacks Hit the Mainstream

guest · Apr 1, 2020

Active Directory Attacks Hit the Mainstream
April 1, 2020
https://www.darkreading.com/endpoin...ory-attacks-hit-the-mainstream/a/d-id/1337405

There was a time when attacks against identity and authentication infrastructure were the domain of well-financed and, likely, state-backed threat actors.

However, the advent of open source pen-testing tools such as Mimikatz — a credential-dumping tool capable of recovering plaintext or hashed passwords from systems — narrowed the knowledge gap necessary to leverage these types of attacks.
Mimikatz, in particular, has been integrated into the arsenals of close to 30 state-sponsored groups and has been used in devastating attacks [...]

Newer tools, including CrackMapExec, Bloodhound, DeathStar, Angry Puppy, and Go Fetch, make it easier than ever for attackers to gain a foothold on a target environment in order to quickly forge tickets, replay credentials, or map the plan to expand their control.
Click to expand...

guest · Oct 1, 2021

Half of businesses experience attacks on Active Directory
October 1, 2021
https://betanews.com/2021/10/01/half-businesses-experience-attacks-on-active-directory/

Active Directory, the directory-based identity services platform, is used by 90 percent of enterprises worldwide making it an attractive target for hackers.

New research part sponsored by Attivo Networks and conducted by Enterprise Management Associates (EMA) shows half of organizations experienced an attack on Active Directory in the last two years, with over 40 percent saying the attack was successful.
In addition penetration testers successfully exploited AD exposures 82 percent of the time, which suggests that actual attack findings may be under represented due to lack of visibility to exploits.
Click to expand...

The survey shows a trend in the repeated mention of privilege escalation and over provisioning issues, as well as lack of visibility to understand misuse and policy drift easily. These discoveries all underscore the point that effective Active Directory protection requires close permission control and access management but must also include multiple layers of visibility and live attack detection.
Click to expand...

Attivo Networks: The Rise of Active Directory Exploits: Is it Time to Sound the Alarm?

The prevalence of AD means it isn’t just large organizations that are at risk: EMA found that 50% of organizations studied in the report had experienced an attack on Active Directory within the past one to two years, and over 40% said that their AD implementation had been successfully breached. This highlights that adversaries aren’t just trying to attack AD—they are successfully breaching it at an unacceptable rate.
Click to expand...

guest · Jul 25, 2022

AD security on the test bench
July 25, 2022

Another topic for administrators responsible for using a Microsoft Active Directory (AD) in the enterprise. Rumor has it that many companies rely on Microsoft's AD for their IT in business operations. The stuff has been on the market for 20 years and is arguably quite reliable. But what about security? According to security vendor Semperis, 20-year-old AD technology presents some security challenges.

I found the perspective taken by Sean Deuby, Director of Services at Semperis, quite intriguing. In a post, he does acknowledge that Active Directory did its job for a long time without any problems in the IT of many companies. But now Sean Deuby points out that AD on a network is now increasingly coming into focus from a security perspective. When I blog about security incidents here, where a little more is revealed about the attack vector, the topic of "compromising Active Directory" often comes up.
Click to expand...

The catch: if an attack on AD succeeds, the attacker can misuse these permissions for his own purposes – which, after all, can now be observed frequently in security incidents. However, many companies are not aware of the security risks associated with AD.
Why AD is a problem today
AD is vulnerable for several reasons. First, it was not designed to handle complex security threats. It was developed at a time when there was no ransomware, no sophisticated state-sponsored cyberattacks, and no widespread use of cloud computing. It is a technology from a different time – and therefore it cannot effectively counter many of the modern threats we face today.
Click to expand...

Scope of the threat
AD is not only a problem because it is easy to attack, the profits for attackers are also significant. AD is essentially the key to the kingdom. AD is like a safe where a company keeps the physical keys to its offices. It's the central hub for accessing critical systems – computers, software applications and other resources.

This attack method is dangerous because it is both easy and lucrative.
Click to expand...

Log in or Sign up

Active Directory Attacks Hit the Mainstream

guest Guest

guest Guest

guest Guest

Log in or Sign up

Active Directory Attacks Hit the Mainstream

guest Guest

guest Guest

guest Guest

Useful Searches