Convert Figma logo to code with AI

infosecn1nja logoAD-Attack-Defense

Attack and defend active directory using modern post exploitation adversary tradecraft activity

4,382
1,017
4,382
0
View on GitHub

Top Related Projects

yeyintminthuhtut's avatar

Awesome-Red-Teaming

6,805

List of Awesome Red Teaming Resources

infosecn1nja's avatar

Red-Teaming-Toolkit

8,938

This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.

vysecurity's avatar

RedTips

1,046

Red Team Tips as posted by @vysecurity on Twitter

mantvydasb's avatar

RedTeaming-Tactics-and-Techniques

3,973

Red Teaming Tactics and Techniques

bluscreenofjeff's avatar

Red-Team-Infrastructure-Wiki

4,058

Wiki to collect Red Team infrastructure hardening resources

redcanaryco's avatar

atomic-red-team

9,540

Small and highly portable detection tests based on MITRE's ATT&CK.

Quick Overview

The AD-Attack-Defense repository is a comprehensive resource for Active Directory security. It provides a curated list of tools, techniques, and methodologies for both attacking and defending Active Directory environments. This repository serves as a valuable reference for security professionals, penetration testers, and system administrators working with Active Directory.

Pros

  • Extensive collection of tools and resources for both offensive and defensive Active Directory security
  • Well-organized structure with clear categorization of different attack vectors and defense strategies
  • Regularly updated with new tools and techniques, reflecting the evolving landscape of AD security
  • Includes references to official documentation and reputable sources for further learning

Cons

  • May overwhelm beginners due to the vast amount of information provided
  • Some tools and techniques listed may be outdated or less relevant in certain environments
  • Lacks detailed explanations or tutorials for using the listed tools
  • Could benefit from more context on the ethical use of offensive tools and techniques

Code Examples

This repository is not a code library but rather a curated list of resources. Therefore, there are no code examples to provide.

Getting Started

As this is not a code library, there are no specific getting started instructions. However, users can begin by:

  1. Cloning the repository or downloading the README.md file
  2. Reviewing the table of contents to find relevant sections
  3. Exploring the listed tools and resources based on their specific needs or interests
  4. Following the provided links to learn more about each tool or technique

Competitor Comparisons

yeyintminthuhtut logo

Awesome-Red-Teaming

6,805

List of Awesome Red Teaming Resources

Pros of Awesome-Red-Teaming

  • Broader scope covering various aspects of red teaming beyond just Active Directory
  • More extensive collection of resources, including tools, techniques, and methodologies
  • Regularly updated with new content and contributions from the community

Cons of Awesome-Red-Teaming

  • Less focused on specific Active Directory attack and defense strategies
  • May be overwhelming for beginners due to the vast amount of information
  • Lacks detailed explanations or tutorials for individual techniques

Code Comparison

While both repositories primarily serve as curated lists of resources, they don't contain significant code samples. However, AD-Attack-Defense does include some PowerShell snippets for specific Active Directory attacks. For example:

# AD-Attack-Defense: PowerView example
Get-NetUser | Select-Object samaccountname, description

Awesome-Red-Teaming doesn't typically include code snippets, focusing instead on linking to external resources and tools.

Both repositories are valuable for security professionals, with AD-Attack-Defense being more specialized for Active Directory environments, while Awesome-Red-Teaming offers a comprehensive overview of red teaming practices across various domains.

infosecn1nja logo

Red-Teaming-Toolkit

8,938

This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.

Pros of Red-Teaming-Toolkit

  • Broader scope covering various aspects of red teaming beyond just Active Directory
  • Includes tools and resources for social engineering and physical security testing
  • More frequently updated with recent commits

Cons of Red-Teaming-Toolkit

  • Less focused on Active Directory specific attacks and defenses
  • May be overwhelming for users specifically interested in AD security
  • Lacks the structured attack/defense format found in AD-Attack-Defense

Code Comparison

While both repositories primarily consist of curated lists and resources rather than actual code, here's a comparison of their README structures:

Red-Teaming-Toolkit:

# Red Teaming/Adversary Simulation Toolkit

A collection of open source and commercial tools that aid in red team operations...

## Contents
- [Reconnaissance](#reconnaissance)
- [Initial Access](#initial-access)
- [Delivery](#delivery)
...

AD-Attack-Defense:

# Active Directory Kill Chain Attack & Defense

This document was designed to be a useful, informational asset for those looking to understand the specific tactics...

## Discovery
### Active Directory Enumeration
...

The Red-Teaming-Toolkit uses a more general categorization, while AD-Attack-Defense follows a specific kill chain structure for Active Directory attacks and defenses.

vysecurity logo

RedTips

1,046

Red Team Tips as posted by @vysecurity on Twitter

Pros of RedTips

  • More focused on red team techniques and tips
  • Regularly updated with new content
  • Includes a wider range of topics beyond Active Directory

Cons of RedTips

  • Less structured organization compared to AD-Attack-Defense
  • Lacks detailed explanations for some techniques
  • Does not provide as much defensive guidance

Code Comparison

RedTips:

Get-ADUser -Filter * -Properties * | Select-Object Name,SamAccountName,UserPrincipalName,Enabled,LastLogonDate,PasswordLastSet,PasswordNeverExpires,PasswordExpired | Export-CSV C:\Temp\ADUsers.csv -NoTypeInformation

AD-Attack-Defense:

Import-Module ActiveDirectory
Get-ADComputer -Filter * -Properties * | Select-Object Name,OperatingSystem,OperatingSystemVersion,IPv4Address,LastLogonDate | Export-CSV C:\Temp\ADComputers.csv -NoTypeInformation

Both repositories provide PowerShell scripts for extracting Active Directory information, but they focus on different aspects. RedTips' example retrieves user information, while AD-Attack-Defense's example focuses on computer information.

RedTips offers a broader range of red team techniques and is more frequently updated, making it valuable for offensive security professionals. However, AD-Attack-Defense provides a more structured approach to Active Directory security, covering both attack and defense strategies in greater detail.

mantvydasb logo

RedTeaming-Tactics-and-Techniques

3,973

Red Teaming Tactics and Techniques

Pros of RedTeaming-Tactics-and-Techniques

  • More comprehensive coverage of red teaming techniques beyond just Active Directory
  • Includes practical examples and walkthroughs for various attack scenarios
  • Regularly updated with new techniques and tools

Cons of RedTeaming-Tactics-and-Techniques

  • Less focused on Active Directory-specific attacks and defenses
  • May be overwhelming for beginners due to its broad scope
  • Lacks some of the detailed mitigation strategies found in AD-Attack-Defense

Code Comparison

While both repositories primarily focus on techniques rather than code, here's a brief comparison of how they present command examples:

AD-Attack-Defense:

Get-ADUser -Filter * -Properties * | Select-Object Name, SamAccountName, UserPrincipalName, Enabled

RedTeaming-Tactics-and-Techniques:

Get-NetUser | Select-Object name, samaccountname, description, pwdlastset, logoncount, badpwdcount

Both repositories use PowerShell commands for Active Directory enumeration, but RedTeaming-Tactics-and-Techniques tends to use more diverse tools and languages throughout its content.

bluscreenofjeff logo

Red-Team-Infrastructure-Wiki

4,058

Wiki to collect Red Team infrastructure hardening resources

Pros of Red-Team-Infrastructure-Wiki

  • Broader focus on overall red team infrastructure, not limited to Active Directory
  • Includes detailed guides on setting up and managing C2 infrastructure
  • Covers OPSEC considerations for red team operations

Cons of Red-Team-Infrastructure-Wiki

  • Less specific information on Active Directory attack techniques
  • May not be as up-to-date with the latest AD-specific vulnerabilities and exploits
  • Lacks detailed defensive strategies for protecting against red team tactics

Code Comparison

While both repositories primarily contain documentation rather than code, here's a comparison of their directory structures:

Red-Team-Infrastructure-Wiki:

├── README.md
├── _config.yml
└── resources
    ├── cobalt-strike
    ├── domain-fronting
    ├── phishing
    └── ...

AD-Attack-Defense:

├── README.md
├── Attack
│   ├── Credential Access
│   ├── Discovery
│   ├── Lateral Movement
│   └── ...
└── Defense
    ├── Auditing
    ├── Hardening
    └── ...

The directory structure reflects the different focus areas of each repository, with Red-Team-Infrastructure-Wiki organizing content by infrastructure components and AD-Attack-Defense categorizing information by attack and defense stages.

redcanaryco logo

atomic-red-team

9,540

Small and highly portable detection tests based on MITRE's ATT&CK.

Pros of Atomic Red Team

  • More comprehensive and regularly updated test cases covering a wide range of MITRE ATT&CK techniques
  • Better documentation and easier to use for both red and blue teams
  • Stronger community support and contributions

Cons of Atomic Red Team

  • Focuses primarily on Windows environments, with less coverage for other operating systems
  • May require more setup and configuration for complex test scenarios

Code Comparison

AD-Attack-Defense example (PowerShell):

$UserName = "TestUser"
$Password = ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force
New-LocalUser -Name $UserName -Password $Password

Atomic Red Team example (YAML):

- name: Create Local User
  auto_generated_guid: 5e132176-26e0-490c-a2e5-4a956c921173
  description: Creates a local user on the system
  supported_platforms:
    - windows
  executor:
    name: command_prompt
    command: |
      net user /add #{user_name} #{password}

Both repositories provide valuable resources for testing and improving Active Directory security. AD-Attack-Defense offers a more focused approach on Active Directory-specific attacks and defenses, while Atomic Red Team provides a broader range of test cases across multiple platforms and techniques. The choice between the two depends on the specific needs of the organization and the scope of their security testing efforts.

Convert Figma logo designs to code with AI

Visual Copilot

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

Active Directory Kill Chain Attack & Defense

Summary

This document was designed to be a useful, informational asset for those looking to understand the specific tactics, techniques, and procedures (TTPs) attackers are leveraging to compromise active directory and guidance to mitigation, detection, and prevention. And understand Active Directory Kill Chain Attack and Modern Post Exploitation Adversary Tradecraft Activity.

Table of Contents

Discovery

SPN Scanning

Data Mining

User Hunting

LAPS

AppLocker

Active Directory Federation Services

Privilege Escalation

sAMAccountName Spoofing

Abusing Active Directory Certificate Services

PetitPotam

Zerologon

Passwords in SYSVOL & Group Policy Preferences

MS14-068 Kerberos Vulnerability

DNSAdmins

Kerberos Delegation

Unconstrained Delegation

Constrained Delegation

Resource-Based Constrained Delegation

Insecure Group Policy Object Permission Rights

Insecure ACLs Permission Rights

Domain Trusts

DCShadow

RID

Microsoft SQL Server

Red Forest

Exchange

NTLM Relay & LLMNR/NBNS

Lateral Movement

Microsoft SQL Server Database links

Pass The Hash

System Center Configuration Manager (SCCM)

WSUS

Password Spraying

Automated Lateral Movement

Defense Evasion

In-Memory Evasion

Endpoint Detection and Response (EDR) Evasion

OPSEC

Microsoft ATA & ATP Evasion

PowerShell ScriptBlock Logging Bypass

PowerShell Anti-Malware Scan Interface (AMSI) Bypass

Loading .NET Assemblies Anti-Malware Scan Interface (AMSI) Bypass

AppLocker & Device Guard Bypass

Sysmon Evasion

HoneyTokens Evasion

Disabling Security Tools

Credential Dumping

NTDS.DIT Password Extraction

SAM (Security Accounts Manager)

Kerberoasting

Kerberos AP-REP Roasting

Windows Credential Manager/Vault

DCSync

LLMNR/NBT-NS Poisoning

Others

Persistence

Diamond Ticket

Golden Ticket

SID History

Silver Ticket

DCShadow

AdminSDHolder

Group Policy Object

Skeleton Keys

SeEnableDelegationPrivilege

Security Support Provider

Directory Services Restore Mode

ACLs & Security Descriptors

Tools & Scripts

  • Certify - Certify is a C# tool to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS).
  • PSPKIAudit - PowerShell toolkit for auditing Active Directory Certificate Services (AD CS).
  • PowerView - Situational Awareness PowerShell framework
  • BloodHound - Six Degrees of Domain Admin
  • Impacket - Impacket is a collection of Python classes for working with network protocols
  • aclpwn.py - Active Directory ACL exploitation with BloodHound
  • CrackMapExec - A swiss army knife for pentesting networks
  • ADACLScanner - A tool with GUI or command linte used to create reports of access control lists (DACLs) and system access control lists (SACLs) in Active Directory
  • zBang - zBang is a risk assessment tool that detects potential privileged account threats
  • SafetyKatz - SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subTee's .NET PE Loader.
  • SharpDump - SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 functionality.
  • PowerUpSQL - A PowerShell Toolkit for Attacking SQL Server
  • Rubeus - Rubeus is a C# toolset for raw Kerberos interaction and abuses
  • ADRecon - A tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment
  • Mimikatz - Utility to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory but also perform pass-the-hash, pass-the-ticket or build Golden tickets
  • Grouper - A PowerShell script for helping to find vulnerable settings in AD Group Policy.
  • Powermad - PowerShell MachineAccountQuota and DNS exploit tools
  • RACE - RACE is a PowerShell module for executing ACL attacks against Windows targets.
  • DomainPasswordSpray - DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain.
  • MailSniper - MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.)
  • LAPSToolkit - Tool to audit and attack LAPS environments.
  • CredDefense - Credential and Red Teaming Defense for Windows Environments
  • ldapdomaindump - Active Directory information dumper via LDAP
  • SpoolSample - PoC tool to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface
  • adconnectdump - Azure AD Connect password extraction
  • o365recon - Script to retrieve information via O365 with a valid cred
  • ROADtools - ROADtools is a framework to interact with Azure AD. I
  • Stormspotter - Stormspotter creates an “attack graph” of the resources in an Azure subscription.
  • AADInternals - AADInternals is PowerShell module for administering Azure AD and Office 365
  • MicroBurst: A PowerShell Toolkit for Attacking Azure - MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping.
  • sam-the-admin - Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user
  • CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter. - CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter. Yet another low effort domain user to domain admin exploit.
  • ADModule - Microsoft signed ActiveDirectory PowerShell module
  • ImproHound - Identify the attack paths in BloodHound breaking your AD tiering
  • ADExplorerSnapshot.py - ADExplorerSnapshot.py is an AD Explorer snapshot ingestor for BloodHound.
  • orpheus - Bypassing Kerberoast Detections with Modified KDC Options and Encryption Types
  • BackupOperatorToolkit

Ebooks

Cheat Sheets

Other Resources

Azure Active Directory

Defense & Detection

Tools & Scripts

  • Invoke-TrimarcADChecks - The Invoke-TrimarcADChecks.ps1 PowerShell script is designed to gather data from a single domain AD forest to performed Active Directory Security Assessment (ADSA).
  • Create-Tiers in AD - Project Title Active Directory Auto Deployment of Tiers in any environment
  • SAMRi10 - Hardening SAM Remote Access in Windows 10/Server 2016
  • Net Cease - Hardening Net Session Enumeration
  • PingCastle - A tool designed to assess quickly the Active Directory security level with a methodology based on risk assessment and a maturity framework
  • Aorato Skeleton Key Malware Remote DC Scanner - Remotely scans for the existence of the Skeleton Key Malware
  • Reset the krbtgt account password/keys - This script will enable you to reset the krbtgt account password and related keys while minimizing the likelihood of Kerberos authentication issues being caused by the operation
  • Reset The KrbTgt Account Password/Keys For RWDCs/RODCs
  • RiskySPN - RiskySPNs is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs (Service Principal Name).
  • Deploy-Deception - A PowerShell module to deploy active directory decoy objects
  • SpoolerScanner - Check if MS-RPRN is remotely available with powershell/c#
  • dcept - A tool for deploying and detecting use of Active Directory honeytokens
  • LogonTracer - Investigate malicious Windows logon by visualizing and analyzing Windows event log
  • DCSYNCMonitor - Monitors for DCSYNC and DCSHADOW attacks and create custom Windows Events for these events
  • Sigma - Generic Signature Format for SIEM Systems
  • Sysmon - System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log.
  • SysmonSearch - Investigate suspicious activity by visualizing Sysmon's event log
  • ClrGuard - ClrGuard is a proof of concept project to explore instrumenting the Common Language Runtime (CLR) for security purposes.
  • Get-ClrReflection - Detects memory-only CLR (.NET) modules.
  • Get-InjectedThread - Get-InjectedThread looks at each running thread to determine if it is the result of memory injection.
  • SilkETW - SilkETW & SilkService are flexible C# wrappers for ETW, they are meant to abstract away the complexities of ETW and give people a simple interface to perform research and introspection.
  • WatchAD - AD Security Intrusion Detection System
  • Sparrow - Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications in the Azure/m365 environment.
  • DFIR-O365RC - The DFIR-O365RC PowerShell module is a set of functions that allow the DFIR analyst to collect logs relevant for Office 365 Business Email Compromise investigations.
  • AzureADIncidentResponse - Tooling to assist in Azure AD incident response
  • ADTimeline - The ADTimeline script generates a timeline based on Active Directory replication metadata for objects considered of interest.
  • Locksmith - A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.
  • FalconHound - FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log aggregation tool.
  • PlumHound - Bloodhound for Blue and Purple Teams.

Sysmon Configuration

  • sysmon-modular - A Sysmon configuration repository for everybody to customise
  • sysmon-dfir - Sources, configuration and how to detect evil things utilizing Microsoft Sysmon.
  • sysmon-config - Sysmon configuration file template with default high-quality event tracing

Active Directory Security Checks (by Sean Metcalf - @Pyrotek3)

General Recommendations

  • Manage local Administrator passwords (LAPS).
  • Implement RDP Restricted Admin mode (as needed).
  • Remove unsupported OSs from the network.
  • Monitor scheduled tasks on sensitive systems (DCs, etc.).
  • Ensure that OOB management passwords (DSRM) are changed regularly & securely stored.
  • Use SMB v2/v3+
  • Default domain Administrator & KRBTGT password should be changed every year & when an AD admin leaves.
  • Remove trusts that are no longer necessary & enable SID filtering as appropriate.
  • All domain authentications should be set (when possible) to: "Send NTLMv2 response onlyrefuse LM & NTLM."
  • Block internet access for DCs, servers, & all administration systems.

Protect Admin Credentials

  • No "user" or computer accounts in admin groups.
  • Ensure all admin accounts are "sensitive & cannot be delegated".
  • Add admin accounts to "Protected Users" group (requires Windows Server 2012 R2 Domain Controllers, 2012R2 DFL for domain protection).
  • Disable all inactive admin accounts and remove from privileged groups.

Protect AD Admin Credentials

  • Limit AD admin membership (DA, EA, Schema Admins, etc.) & only use custom delegation groups.
  • ‘Tiered’ Administration mitigating credential theft impact.
  • Ensure admins only logon to approved admin workstations & servers.
  • Leverage time-based, temporary group membership for all admin accounts

Protect Service Account Credentials

  • Limit to systems of the same security level.
  • Leverage “(Group) Managed Service Accounts” (or PW >20 characters) to mitigate credential theft (kerberoast).
  • Implement FGPP (DFL =>2008) to increase PW requirements for SAs and administrators.
  • Logon restrictions – prevent interactive logon & limit logon capability to specific computers.
  • Disable inactive SAs & remove from privileged groups.

Protect Resources

  • Segment network to protect admin & critical systems.
  • Deploy IDS to monitor the internal corporate network.
  • Network device & OOB management on separate network.

Protect Domain Controllers

  • Only run software & services to support AD.
  • Minimal groups (& users) with DC admin/logon rights.
  • Ensure patches are applied before running DCPromo (especially MS14-068 and other critical patches).
  • Validate scheduled tasks & scripts.

Protect Workstations (& Servers)

  • Patch quickly, especially privilege escalation vulnerabilities.
  • Deploy security back-port patch (KB2871997).
  • Set Wdigest reg key to 0 (KB2871997/Windows 8.1/2012R2+): HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecurityProvidersWdigest
  • Deploy workstation whitelisting (Microsoft AppLocker) to block code exec in user folders – home dir & profile path.
  • Deploy workstation app sandboxing technology (EMET) to mitigate application memory exploits (0-days).

Logging

  • Enable enhanced auditing
  • “Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings”
  • Enable PowerShell module logging (“*”) & forward logs to central log server (WEF or other method).
  • Enable CMD Process logging & enhancement (KB3004375) and forward logs to central log server.
  • SIEM or equivalent to centralize as much log data as possible.
  • User Behavioural Analysis system for enhanced knowledge of user activity (such as Microsoft ATA).

Security Pro’s Checks

  • Identify who has AD admin rights (domain/forest).
  • Identify who can logon to Domain Controllers (& admin rights to virtual environment hosting virtual DCs).
  • Scan Active Directory Domains, OUs, AdminSDHolder, & GPOs for inappropriate custom permissions.
  • Ensure AD admins (aka Domain Admins) protect their credentials by not logging into untrusted systems (workstations).
  • Limit service account rights that are currently DA (or equivalent).

Important Security Updates

CVETitleDescriptionLink
CVE-2020-1472Netlogon Elevation of Privilege VulnerabilityAn elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network.https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472
CVE-2019-1040Windows NTLM Tampering VulnerabilityA tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection, aka 'Windows NTLM Tampering Vulnerability'.https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1040
CVE-2019-0683Active Directory Elevation of Privilege VulnerabilityAn elevation of privilege vulnerability exists in Active Directory Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Active Directory Elevation of Privilege Vulnerability'.https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0683
CVE-2019-0708Remote Desktop Services Remote Code Execution VulnerabilityA remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708
CVE-2018-8581Microsoft Exchange Server Elevation of Privilege VulnerabilityAn elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8518
CVE-2017-0143Windows SMB Remote Code Execution VulnerabilityThe SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148.https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143
CVE-2016-0128Windows SAM and LSAD Downgrade VulnerabilityThe SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 do not properly establish an RPC channel, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka "Windows SAM and LSAD Downgrade Vulnerability" or "BADLOCK."https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-0128
CVE-2014-6324Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780)The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator privileges via a forged signature in a ticket, as exploited in the wild in November 2014, aka "Kerberos Checksum Vulnerability."https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-068
CVE-2014-1812Vulnerability in Group Policy Preferences could allow elevation of privilegeThe Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain sensitive credential information and consequently gain privileges by leveraging access to the SYSVOL share, as exploited in the wild in May 2014, aka "Group Policy Preferences Password Elevation of Privilege Vulnerability."https://support.microsoft.com/en-us/help/2962486/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevati

Detection

AttackEvent ID
Account and Group Enumeration4798: A user's local group membership was enumerated
4799: A security-enabled local group membership was enumerated
AdminSDHolder4780: The ACL was set on accounts which are members of administrators groups
Kekeo4624: Account Logon
4672: Admin Logon
4768: Kerberos TGS Request
Silver Ticket4624: Account Logon
4634: Account Logoff
4672: Admin Logon
Golden Ticket4624: Account Logon
4672: Admin Logon
PowerShell4103: Script Block Logging
400: Engine Lifecycle
403: Engine Lifecycle
4103: Module Logging
600: Provider Lifecycle
DCShadow4742: A computer account was changed
5137: A directory service object was created
5141: A directory service object was deleted
4929: An Active Directory replica source naming context was removed
Skeleton Keys4673: A privileged service was called
4611: A trusted logon process has been registered with the Local Security Authority
4688: A new process has been created
4689: A new process has exited
PYKEK MS14-0684672: Admin Logon
4624: Account Logon
4768: Kerberos TGS Request
Kerberoasting4769: A Kerberos ticket was requested
S4U2Proxy4769: A Kerberos ticket was requested
Lateral Movement4688: A new process has been created
4689: A process has exited
4624: An account was successfully logged on
4625: An account failed to log on
DNSAdmin770: DNS Server plugin DLL has been loaded
541: The setting serverlevelplugindll on scope . has been set to <dll path>
150: DNS Server could not load or initialize the plug-in DLL
DCSync4662: An operation was performed on an object
Password Spraying4625: An account failed to log on
4771: Kerberos pre-authentication failed
4648: A logon was attempted using explicit credentials

Resources

License

CC0

To the extent possible under law, Rahmat Nurfauzi "@infosecn1nja" has waived all copyright and related or neighboring rights to this work.