Top Active Directory Attacks: Understand, then Prevent and Detect

on YouTube ↗40m

" summary

Covers concrete AD failures and fixes: email phishing causes 90%+ breaches, internal access plus privileges lets attackers win fast (example: 65 minutes to domain-wide ransomware), common vectors include password spraying and credential stuffing, exposed file shares and MFPs, DNS fallback/LLMNR abuse, and Kerberos attacks (krbtgt golden tickets, silver tickets, Kerberoastable accounts). Shows tools and steps: enumerate subnets with PowerShell, scan with Eyewitness, crackable-service finds via Rubeus, search secrets with Snaffler, and defenses like Azure AD Password Protection, SMB signing and managed service accounts.

AI-written summary · about

" chapters (38)

1. 0:00Introduction
2. 0:27Agenda
3. 0:52Different ways of conceptualizing breaches
4. 1:29Lockheed Martin Cyberkill Train trademark
5. 1:45What every attacker or attack needs
6. 2:12Internal access
7. 3:15Why internal access
8. 4:02A 10000 employee company
9. 5:12Twitter breach
10. 5:59Finding the right data
11. 7:09X filtration
12. 7:45Ransomware
13. 8:41High Level Picture
14. 9:57Prevent vs Detect
15. 10:23Safes
16. 11:38Assume Breach
17. 12:31Realistic Threat Model
18. 12:59Password Spraying
19. 13:51Single Factor Authentication
20. 14:23Credential Stuffing
21. 15:17File Sharing
22. 16:27dns fallback abuse
23. 17:44Look printers
24. 18:42Kerberos roasting
25. 18:52What are kerberos
26. 21:11normal flow
27. 21:30analogies
28. 24:19authentication
29. 25:23ticket granting
30. 26:08service ticket
31. 26:49kerberos steam
32. 29:05preventive detective controls
33. 31:28password protection
34. 32:24printers
35. 34:48sensitive files
36. 35:24longterm action
37. 36:37fallback abuse
38. 38:38Jeff

" related talks

• 50mHybrid Active Directory Attacks: Anatomy and DefensesDerek Melber · RSA Conference 2023
• 50mBeyond the Mcse: Active Directory for the Security ProfessionalSean Metcalf · Black Hat USA 2016
• 49mSecuring Entry Points and Active Directory to Prevent Ransomware AttacksDerek Melber · RSAC 2022
• 32mRansomware, Risk, & Recovery: Protecting and Creating Resilience for Hybrid Active DirectoryCalum Field · 34th Annual FIRST Conference 2022
• 37mThreat Hunting in Active Directory EnvironmentAnurag Khanna, Thirumalai Natarajan Muthiah · Black Hat Asia 2021
• 53mThe Importance of Identity-Centric Security in 2024Vivin Sathyan · RSA Conference 2024
• 50mAttacking and Defending the Microsoft Cloud (Office 365 & Azure AD)Sean Metcalf, Mark Morowczynski · Black Hat USA 2019
• 42mWriting Your Own Ticket to the Cloud Like APT: A Dive to AD FS Attacks, Detections, and MitigationsRoberto Rodriguez, Nestori Syynimaa · Black Hat Europe 2022