Thread by @_wald0

I’m a firm believer in the (cliche) adage, “Outcomes, not output.” It’s not about the number of lines of code you wrote in 2021, but the impact those lines of code had - the outcomes they created. Here’s 5 small things you can do in 2022 to create big AD security outcomes:

#1: Audit the owners of your domain controller computer objects. Update the owner of each object to the Domain Admins group for that domain.

Time required: up to 1 hour
Potential attack path impact: extremely high.
Risk of breaking something: very low

#2: Use BloodHound to find where Domain Users/Everyone/Auth Users has privileged access, and remove all such instances.

Time required: up to 1 week
Potential attack path impact: extremely high.
Risk of breaking something: low

#3: Add every Domain Admin to the Protected Users group.

Time required: up to 1 hour
Potential attack path impact: high.
Risk of breaking something: medium, but easily resolved with using daily driver accounts for services that require delegation or NTLM auth

#4: Use BloodHound to audit who has control of your Azure sync account, and remove anyone not in tier zero.

Time required: up to 1 hour
Potential attack path impact: extremely high.
Risk of breaking something: very low

#5: Audit who has control of GPOs that apply to your DCs and DAs. Remove anyone not in tier zero.

Time required: up to 1 hour
Potential attack path impact: extremely high.
Risk of breaking something: very low

Do these 5 things and you can eliminate millions or billions of possible attack paths in your AD environment.

Need more detail? This blog post dives much deeper: posts.specterops.io/bloodhound-ver…