Why Hackers Abuse Active Directory

guest · Jul 25, 2019

Why Hackers Abuse Active Directory
From Ransomware to APT Attacks, AD Can Make Connecting to Systems Easy
July 25, 2019
https://www.inforisktoday.com/hackers-abuse-active-directory-a-12825

Security experts say that Active Directory, built into most Windows Server operating systems, has become the dominant approach to managing Windows domain networks. But its ease of use can also be tapped by hackers.

"Active Directory is the core identity platform for many businesses around the world," says Huy Kha, an information security professional at a Dutch law firm who's an expert on Active Directory security.
"It is used to connect different systems to each other. So that means that it has also become a prime target," he tells Information Security Media Group.
Other hackers also regularly target or leverage Active Directory. After gaining initial access to a network, the hacking group APT15 - aka K3chang, Mirage, Vixen Panda, GREF and Playful Dragon - uses a custom-developed tool that can bulk export AD data, NCC Group reports.
Click to expand...

guest · Jul 27, 2019

Essential Active Directory Security Defenses
Lock Down Directory Management Environment to Block Abuse by Hackers
July 26, 2019
https://www.bankinfosecurity.com/essential-active-directory-security-defenses-a-12828

A common Active Directory security problems, he says, is built-in service accounts, which too often can be accessed via the same password - on every workstation in an organization - as well as provide admin-level rights. Another problem is that by default, Active Directory workstations can communicate with each other, which attackers can abuse to move laterally across networks.

When I point out to people that they need to very carefully structure permissions and tightly control admin rights, what admins can do, and where the can connect from ... it's seen as overwhelmingly complex and of little value."
Retire Outdated Windows Systems
One quick-hit improvement - with upsides for Active Directory security as well as security in general - is to retire outdated Windows systems, says Tod Beardsley, director of research at Rapid7.
By comparison, retiring old Windows systems makes attackers' job tougher.

Having a plan of attack is also essential. Kha recommends finding a good framework for approaching Active Directory and ensuring that it has been hardened, for example, by implementing Microsoft best practices and also migrating to a "Red Forest" architecture.
Click to expand...

guest · Aug 7, 2019

Fighting Active Directory Attacks with Deception
Attivo’s ADSecure thwarts Active Directory attacks by guiding hackers to a deception infrastructure instead of the real one
August 6, 2019
https://www.itprotoday.com/threat-management/fighting-active-directory-attacks-deception

With the vast majority of organizations using some form of Microsoft’s Active Directory to consolidate and manage networked resources, the directory service is a popular target for cybercriminals. It’s particularly attractive to attackers because it contains centralized information about an organization’s entire network.

Many of the problems companies experience with Active Directory come from inadequate credential management, administrative users and privileged access;
Active Directory attacks generally focus on extracting privileged domain accounts, system accounts and high-value systems.

ADSecure, which can be run as a standalone product or as part of the company’s ThreatDefend Detection Platform, focuses on preventing attackers from gathering data from Active Directory.
The approach, as described by the company, is to intercept the calls as they are being made. If it determines that the call may be malicious, it will respond to that query with deceptive data that will guide the attacker to the deception infrastructure instead of the real one.
Click to expand...

Log in or Sign up

Why Hackers Abuse Active Directory

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Hackers Abuse Active Directory

guest Guest

guest Guest

guest Guest

Useful Searches