1/ Number #5 of the #ActiveDirectory hardening measures:
Add Computers to the Domain
🧵 #CyberSecurity
Add Computers to the Domain
🧵 #CyberSecurity
2/ The following case is still worth mentioning:
A customer called us because he discovered two new computers within his computer objects that did not match his naming scheme.
A customer called us because he discovered two new computers within his computer objects that did not match his naming scheme.
3/ During the detailed investigation of the incident, it turned out that these SAMTHEADMIN objects were part of an exploit code that (if successful) would give administrative rights to a standard domain user.
A more in-depth write-up here:
A more in-depth write-up here:
https://twitter.com/malmoeb/status/1511760068743766026
4/ In addition to the exploit presented above, various other attack techniques rely on the fact that an unprivileged user can create new computer objects within the domain.
5/ The best way to prevent such attacks is to remove this privilege from all users on the network and only explicitly assign it to a particular group (supporters, IT administrators, etc.).
6/ Ping Castle also checks the value of MachineAccountQuota, and outputs a corresponding finding if the value is < 0.
"This default configuration represents a security issue as regular users shouldn't be able to create such accounts, and administrators should handle this task."
"This default configuration represents a security issue as regular users shouldn't be able to create such accounts, and administrators should handle this task."
• • •
Missing some Tweet in this thread? You can try to
force a refresh
