SlideShare a Scribd company logo

The presentation on my "Shadow Admins" research

•Download as PPTX, PDF•
•
A
Asaf Hecht

Shadow Admins are powerful and stealthy privileged accounts - attacker & defenders must know about them.

Technology
1 of 25
Lavi Lazarovitz Security Research Team Lead Asaf Hecht Security Researcher Shadow Admins
Shadow Admins: Underground Accounts That Undermine The Network Admin A Privileged Accounts Admin B Shadow Admin
Shadow Admins: Underground Accounts That Undermine The Network Industry Standards SHADOW ADMIN
Shadow Admins: Underground Accounts That Undermine The Network Industry Standards Privileged account An information system account with authorizations of a privileged user Privileged user [CNSSI 4009] A user that is authorized (and therefore, trusted) to perform security-relevant functions that ordinary users are not authorized to perform
Shadow Admins: Underground Accounts That Undermine The Network Discovering Privileged Accounts Built-in Admin Groups Active Directory Shadow Admins C: NET GROUPS /Domain _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ * Enterprise Admins * Domain Admins * Account Operators * Schema Admins C: NET GROUPS /Domain _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ * Administrators_Global * A_Admins_UK * Server_Admins_Local * WS_Admins_Local Organization Defined Groups
Shadow Admins: Underground Accounts That Undermine The Network Shadow Admins Name: Shadow Admin D.O.B.: Not part of any privilege group ID #: S-1-5-21-3623812015- 3361044358-30301820-1014 Issued: 08/06/2017 Expires: NEVER IDENTIFICATION CARD Shadow Admin has Direct Privilege Permissions!
Shadow Admins: Underground Accounts That Undermine The Network Permissions and ACLs - on directories READ ONLY SYSTEM Administrators User1 Guest FULL CONTROL READ & WRITE
Shadow Admins: Underground Accounts That Undermine The Network Permissions and ACLs - in Active Directory SYSTEM Enterprise Admins Domain Admins Authenticated Users User1 User2 ACLAD Objects Groups Domain root Containers GPOs FULL CONTROL CREATE CHILD OBJECTS DELETE CHILD OBJECTS CHANGE PASSWORD READ ONLY READ ONLY READ ONLY CHANGE PASSWORD
LET’S SEE IT
Shadow Admins: Underground Accounts That Undermine The Network Active Directory - Object tree and ACL
Shadow Admins: Underground Accounts That Undermine The Network Active Directory - Object tree and ACL
Shadow Admins: Underground Accounts That Undermine The Network Group assignment: Direct assignment: Direct vs Group ACL Assignment
Shadow Admins: Underground Accounts That Undermine The Network Direct vs Group ACL Assignment Account Emily has DC Sync permission: Domain and can steal all the passwords: Account Emily has Reset Password permission: on Administrator account Administrator account:
Shadow Admins: Underground Accounts That Undermine The Network Privilege Escalation The Red Side Scenarios Persistence
Shadow Admins: Underground Accounts That Undermine The Network C: NET LOCALGROUP _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ * Administrators ** Load and unload device drivers ** Manage Auditing and security logs * Remote Desktop Users ** Allow logon through remote desktop services User Rights - Local Privileged Accounts
WATCH THE USER RIGHTS
Shadow Admins: Underground Accounts That Undermine The Network Local User Rights
Shadow Admins: Underground Accounts That Undermine The Network User Rights Attack
Shadow Admins: Underground Accounts That Undermine The Network Our Free Tool - ACLight - Shadow Admin Scanner PowerShell GitHub Automatic
SHADOW ADMIN SCANNER
Shadow Admins: Underground Accounts That Undermine The Network Privilege ACL Scanner - Results
Shadow Admins: Underground Accounts That Undermine The Network Privilege ACL Scanner - Results Full CSV output – every account and its privileged permission:
Shadow Admins: Underground Accounts That Undermine The Network Light In The Shadows Domain Groups Shadow Admins Local Groups
Shadow Admins: Underground Accounts That Undermine The Network Download & Run Free: https://github.com/CyberArkLabs/ACLight Lavi.Lazarovitz@cyberark.com, @LaviLazarovitz Asaf.Hecht@cyberark.com, @Hechtov
Shadow Admins: Underground Accounts That Undermine The Network Actionable Takeaways KNOW all your privileged accounts in the network: • By group assignments • By ACLs analysis of the Active Directory HOW: • Scan your network for Shadow Admins - who have sensitive direct permissions • Use our free privileged ACLs scanning tool: https://github.com/CyberArkLabs/ACLight SECURE those new detected privileged accounts!

Recommended

MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
n|u - The Open Security Community
 
Cloud Access Security Brokers - CASB
Cloud Access Security Brokers - CASB Cloud Access Security Brokers - CASB
Cloud Access Security Brokers - CASB
Samrat Das
 
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
Iftikhar Ali Iqbal
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval
 
Secure code practices
Secure code practicesSecure code practices
Secure code practices
Hina Rawal
 
Microsoft Zero Trust
Microsoft Zero TrustMicrosoft Zero Trust
Microsoft Zero Trust
David J Rosenthal
 
Broken access controls
Broken access controlsBroken access controls
Broken access controls
Akansha Kesharwani
 

Recommended

MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
n|u - The Open Security Community
 
Cloud Access Security Brokers - CASB
Cloud Access Security Brokers - CASB Cloud Access Security Brokers - CASB
Cloud Access Security Brokers - CASB
Samrat Das
 
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
McAfee - MVISION Cloud (MVC) - Cloud Access Security Broker (CASB) - POC Docu...
Iftikhar Ali Iqbal
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
Arpan Raval
 
Secure code practices
Secure code practicesSecure code practices
Secure code practices
Hina Rawal
 
Microsoft Zero Trust
Microsoft Zero TrustMicrosoft Zero Trust
Microsoft Zero Trust
David J Rosenthal
 
Broken access controls
Broken access controlsBroken access controls
Broken access controls
Akansha Kesharwani
 
Demystifying Initial Access in Azure
Demystifying Initial Access in AzureDemystifying Initial Access in Azure
Demystifying Initial Access in Azure
Gabriel Mathenge
 
OWASP Top 10 2021 What's New
OWASP Top 10 2021 What's NewOWASP Top 10 2021 What's New
OWASP Top 10 2021 What's New
Michael Furman
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
Bhushan Gurav
 
Cybersecurity Basics - Aravindr.com
Cybersecurity Basics - Aravindr.comCybersecurity Basics - Aravindr.com
Cybersecurity Basics - Aravindr.com
Aravind R
 
SOME ve SOC Ekipleri İçin Açık Kaynak Çözümler
SOME ve SOC Ekipleri İçin Açık Kaynak ÇözümlerSOME ve SOC Ekipleri İçin Açık Kaynak Çözümler
SOME ve SOC Ekipleri İçin Açık Kaynak Çözümler
BGA Cyber Security
 
10 Adımda Sızma Testleri
10 Adımda Sızma Testleri10 Adımda Sızma Testleri
10 Adımda Sızma Testleri
BGA Cyber Security
 
Mapping ATT&CK Techniques to ENGAGE Activities
Mapping ATT&CK Techniques to ENGAGE ActivitiesMapping ATT&CK Techniques to ENGAGE Activities
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
Cloud App Security Customer Presentation.pdf
Cloud App Security Customer Presentation.pdfCloud App Security Customer Presentation.pdf
Cloud App Security Customer Presentation.pdf
ErikHof4
 
EDR vs SIEM - The fight is on
EDR vs SIEM - The fight is onEDR vs SIEM - The fight is on
EDR vs SIEM - The fight is on
Justin Henderson
 
Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]
RootedCON
 
Role of Forensic Triage In Cyber Security Trends 2021
Role of Forensic Triage In Cyber Security Trends 2021Role of Forensic Triage In Cyber Security Trends 2021
Role of Forensic Triage In Cyber Security Trends 2021
Amrit Chhetri
 
Application Threat Modeling
Application Threat ModelingApplication Threat Modeling
Application Threat Modeling
Priyanka Aash
 
ReCertifying Active Directory
ReCertifying Active DirectoryReCertifying Active Directory
ReCertifying Active Directory
Will Schroeder
 
Threat Modeling Using STRIDE
Threat Modeling Using STRIDEThreat Modeling Using STRIDE
Threat Modeling Using STRIDE
Girindro Pringgo Digdo
 
ATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CKATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CK
MITRE ATT&CK
 
Derbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active DirectoryDerbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active Directory
Will Schroeder
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels
 
Security operations center 5 security controls
Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controls
AlienVault
 
Microsoft Security - New Capabilities In Microsoft 365 E5 Plans
Microsoft Security - New Capabilities In Microsoft 365 E5 PlansMicrosoft Security - New Capabilities In Microsoft 365 E5 Plans
Microsoft Security - New Capabilities In Microsoft 365 E5 Plans
David J Rosenthal
 
Micro segmentation and zero trust for security and compliance - Guardicore an...
Micro segmentation and zero trust for security and compliance - Guardicore an...Micro segmentation and zero trust for security and compliance - Guardicore an...
Micro segmentation and zero trust for security and compliance - Guardicore an...
YouAttestSlideshare
 
Shadow admins
Shadow adminsShadow admins
Shadow admins
Lavi Lazarovitz
 
Secure active directory in one day without spending a single dollar
Secure active directory in one day without spending a single dollarSecure active directory in one day without spending a single dollar
Secure active directory in one day without spending a single dollar
David Rowe
 

More Related Content

What's hot

Microsoft Security - New Capabilities In Microsoft 365 E5 Plans
Microsoft Security - New Capabilities In Microsoft 365 E5 PlansMicrosoft Security - New Capabilities In Microsoft 365 E5 Plans
Microsoft Security - New Capabilities In Microsoft 365 E5 Plans
David J Rosenthal
 

What's hot (20)

Demystifying Initial Access in Azure
Demystifying Initial Access in AzureDemystifying Initial Access in Azure
Demystifying Initial Access in Azure
 
OWASP Top 10 2021 What's New
OWASP Top 10 2021 What's NewOWASP Top 10 2021 What's New
OWASP Top 10 2021 What's New
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
 
Cybersecurity Basics - Aravindr.com
Cybersecurity Basics - Aravindr.comCybersecurity Basics - Aravindr.com
Cybersecurity Basics - Aravindr.com
 
SOME ve SOC Ekipleri İçin Açık Kaynak Çözümler
SOME ve SOC Ekipleri İçin Açık Kaynak ÇözümlerSOME ve SOC Ekipleri İçin Açık Kaynak Çözümler
SOME ve SOC Ekipleri İçin Açık Kaynak Çözümler
 
10 Adımda Sızma Testleri
10 Adımda Sızma Testleri10 Adımda Sızma Testleri
10 Adımda Sızma Testleri
 
Mapping ATT&CK Techniques to ENGAGE Activities
Mapping ATT&CK Techniques to ENGAGE ActivitiesMapping ATT&CK Techniques to ENGAGE Activities
Mapping ATT&CK Techniques to ENGAGE Activities
 
Cloud App Security Customer Presentation.pdf
Cloud App Security Customer Presentation.pdfCloud App Security Customer Presentation.pdf
Cloud App Security Customer Presentation.pdf
 
EDR vs SIEM - The fight is on
EDR vs SIEM - The fight is onEDR vs SIEM - The fight is on
EDR vs SIEM - The fight is on
 
Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]Carlos García - Pentesting Active Directory Forests [rooted2019]
Carlos García - Pentesting Active Directory Forests [rooted2019]
 
Role of Forensic Triage In Cyber Security Trends 2021
Role of Forensic Triage In Cyber Security Trends 2021Role of Forensic Triage In Cyber Security Trends 2021
Role of Forensic Triage In Cyber Security Trends 2021
 
Application Threat Modeling
Application Threat ModelingApplication Threat Modeling
Application Threat Modeling
 
ReCertifying Active Directory
ReCertifying Active DirectoryReCertifying Active Directory
ReCertifying Active Directory
 
Threat Modeling Using STRIDE
Threat Modeling Using STRIDEThreat Modeling Using STRIDE
Threat Modeling Using STRIDE
 
ATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CKATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CK
 
Derbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active DirectoryDerbycon - The Unintended Risks of Trusting Active Directory
Derbycon - The Unintended Risks of Trusting Active Directory
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
 
Security operations center 5 security controls
Security operations center 5 security controls Security operations center 5 security controls
Security operations center 5 security controls
 
Microsoft Security - New Capabilities In Microsoft 365 E5 Plans
Microsoft Security - New Capabilities In Microsoft 365 E5 PlansMicrosoft Security - New Capabilities In Microsoft 365 E5 Plans
Microsoft Security - New Capabilities In Microsoft 365 E5 Plans
 
Micro segmentation and zero trust for security and compliance - Guardicore an...
Micro segmentation and zero trust for security and compliance - Guardicore an...Micro segmentation and zero trust for security and compliance - Guardicore an...
Micro segmentation and zero trust for security and compliance - Guardicore an...
 

Similar to The presentation on my "Shadow Admins" research

Secure active directory in one day without spending a single dollar
Secure active directory in one day without spending a single dollarSecure active directory in one day without spending a single dollar
Secure active directory in one day without spending a single dollar
David Rowe
 
Is the door to your active directory wide open and unsecure
Is the door to your active directory wide open and unsecureIs the door to your active directory wide open and unsecure
Is the door to your active directory wide open and unsecure
David Rowe
 
CHAPTER 26 WINDOWS SECURITY 26.1 FUNDAMENTAL
CHAPTER 26 WINDOWS SECURITY 26.1 FUNDAMENTAL CHAPTER 26 WINDOWS SECURITY 26.1 FUNDAMENTAL
CHAPTER 26 WINDOWS SECURITY 26.1 FUNDAMENTAL
EstelaJeffery653
 
BSides SG Practical Red Teaming Workshop
BSides SG Practical Red Teaming WorkshopBSides SG Practical Red Teaming Workshop
BSides SG Practical Red Teaming Workshop
Ajay Choudhary
 
Managing Unix Accounts in Today's Complex World: Stop the Shadow IT and Be Mo...
Managing Unix Accounts in Today's Complex World: Stop the Shadow IT and Be Mo...Managing Unix Accounts in Today's Complex World: Stop the Shadow IT and Be Mo...
Managing Unix Accounts in Today's Complex World: Stop the Shadow IT and Be Mo...
BeyondTrust
 
IT103Microsoft Windows XP/OS Chap13
IT103Microsoft Windows XP/OS Chap13IT103Microsoft Windows XP/OS Chap13
IT103Microsoft Windows XP/OS Chap13
blusmurfydot1
 

Similar to The presentation on my "Shadow Admins" research (20)

Shadow admins
Shadow adminsShadow admins
Shadow admins
 
Secure active directory in one day without spending a single dollar
Secure active directory in one day without spending a single dollarSecure active directory in one day without spending a single dollar
Secure active directory in one day without spending a single dollar
 
Escalation defenses ad guardrails every company should deploy
Escalation defenses ad guardrails every company should deployEscalation defenses ad guardrails every company should deploy
Escalation defenses ad guardrails every company should deploy
 
Is the door to your active directory wide open and unsecure
Is the door to your active directory wide open and unsecureIs the door to your active directory wide open and unsecure
Is the door to your active directory wide open and unsecure
 
UNIT 6-EXPLAINING THE ROLE OF THE NETWORK ADMINISTRATOR AND SUPPORT.pptx
UNIT 6-EXPLAINING THE ROLE OF THE NETWORK ADMINISTRATOR AND SUPPORT.pptxUNIT 6-EXPLAINING THE ROLE OF THE NETWORK ADMINISTRATOR AND SUPPORT.pptx
UNIT 6-EXPLAINING THE ROLE OF THE NETWORK ADMINISTRATOR AND SUPPORT.pptx
 
Owasp web security
Owasp web securityOwasp web security
Owasp web security
 
Windows Server 2012 Managing Active Directory Domain
Windows Server 2012 Managing Active Directory DomainWindows Server 2012 Managing Active Directory Domain
Windows Server 2012 Managing Active Directory Domain
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
 
Secure Active Directory in one Day Without Spending a Single Dollar
Secure Active Directory in one Day Without Spending a Single DollarSecure Active Directory in one Day Without Spending a Single Dollar
Secure Active Directory in one Day Without Spending a Single Dollar
 
CHAPTER 26 WINDOWS SECURITY 26.1 FUNDAMENTAL
CHAPTER 26 WINDOWS SECURITY 26.1 FUNDAMENTAL CHAPTER 26 WINDOWS SECURITY 26.1 FUNDAMENTAL
CHAPTER 26 WINDOWS SECURITY 26.1 FUNDAMENTAL
 
User id installation and configuration
User id installation and configurationUser id installation and configuration
User id installation and configuration
 
BSides SG Practical Red Teaming Workshop
BSides SG Practical Red Teaming WorkshopBSides SG Practical Red Teaming Workshop
BSides SG Practical Red Teaming Workshop
 
Managing Unix Accounts in Today's Complex World: Stop the Shadow IT and Be Mo...
Managing Unix Accounts in Today's Complex World: Stop the Shadow IT and Be Mo...Managing Unix Accounts in Today's Complex World: Stop the Shadow IT and Be Mo...
Managing Unix Accounts in Today's Complex World: Stop the Shadow IT and Be Mo...
 
Dynamics CRM Harsha PPT
Dynamics CRM Harsha PPTDynamics CRM Harsha PPT
Dynamics CRM Harsha PPT
 
The Perimeter Is Dead
The Perimeter Is DeadThe Perimeter Is Dead
The Perimeter Is Dead
 
Cis controls v8_guide (1)
Cis controls v8_guide (1)Cis controls v8_guide (1)
Cis controls v8_guide (1)
 
Case Study: Privileged Access in a World on Time
Case Study: Privileged Access in a World on TimeCase Study: Privileged Access in a World on Time
Case Study: Privileged Access in a World on Time
 
Creating a fortress in your active directory environment
Creating a fortress in your active directory environmentCreating a fortress in your active directory environment
Creating a fortress in your active directory environment
 
Ceh v5 module 04 enumeration
Ceh v5 module 04 enumerationCeh v5 module 04 enumeration
Ceh v5 module 04 enumeration
 
IT103Microsoft Windows XP/OS Chap13
IT103Microsoft Windows XP/OS Chap13IT103Microsoft Windows XP/OS Chap13
IT103Microsoft Windows XP/OS Chap13
 

Recently uploaded

Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
panagenda
 
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Roshan Dwivedi
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
UK Journal
 
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
Principled Technologies
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
Principled Technologies
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Miguel Araújo
 

Recently uploaded (20)

Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
 
Top 10 Most Downloaded Games on Play Store in 2024
Top 10 Most Downloaded Games on Play Store in 2024Top 10 Most Downloaded Games on Play Store in 2024
Top 10 Most Downloaded Games on Play Store in 2024
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live StreamsTop 5 Benefits OF Using Muvi Live Paywall For Live Streams
Top 5 Benefits OF Using Muvi Live Paywall For Live Streams
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
Deploy with confidence: VMware Cloud Foundation 5.1 on next gen Dell PowerEdg...
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 

The presentation on my "Shadow Admins" research

  • 1. Lavi Lazarovitz Security Research Team Lead Asaf Hecht Security Researcher Shadow Admins
  • 2. Shadow Admins: Underground Accounts That Undermine The Network Admin A Privileged Accounts Admin B Shadow Admin
  • 3. Shadow Admins: Underground Accounts That Undermine The Network Industry Standards SHADOW ADMIN
  • 4. Shadow Admins: Underground Accounts That Undermine The Network Industry Standards Privileged account An information system account with authorizations of a privileged user Privileged user [CNSSI 4009] A user that is authorized (and therefore, trusted) to perform security-relevant functions that ordinary users are not authorized to perform
  • 5. Shadow Admins: Underground Accounts That Undermine The Network Discovering Privileged Accounts Built-in Admin Groups Active Directory Shadow Admins C: NET GROUPS /Domain _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ * Enterprise Admins * Domain Admins * Account Operators * Schema Admins C: NET GROUPS /Domain _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ * Administrators_Global * A_Admins_UK * Server_Admins_Local * WS_Admins_Local Organization Defined Groups
  • 6. Shadow Admins: Underground Accounts That Undermine The Network Shadow Admins Name: Shadow Admin D.O.B.: Not part of any privilege group ID #: S-1-5-21-3623812015- 3361044358-30301820-1014 Issued: 08/06/2017 Expires: NEVER IDENTIFICATION CARD Shadow Admin has Direct Privilege Permissions!
  • 7. Shadow Admins: Underground Accounts That Undermine The Network Permissions and ACLs - on directories READ ONLY SYSTEM Administrators User1 Guest FULL CONTROL READ & WRITE
  • 8. Shadow Admins: Underground Accounts That Undermine The Network Permissions and ACLs - in Active Directory SYSTEM Enterprise Admins Domain Admins Authenticated Users User1 User2 ACLAD Objects Groups Domain root Containers GPOs FULL CONTROL CREATE CHILD OBJECTS DELETE CHILD OBJECTS CHANGE PASSWORD READ ONLY READ ONLY READ ONLY CHANGE PASSWORD
  • 10. Shadow Admins: Underground Accounts That Undermine The Network Active Directory - Object tree and ACL
  • 11. Shadow Admins: Underground Accounts That Undermine The Network Active Directory - Object tree and ACL
  • 12. Shadow Admins: Underground Accounts That Undermine The Network Group assignment: Direct assignment: Direct vs Group ACL Assignment
  • 13. Shadow Admins: Underground Accounts That Undermine The Network Direct vs Group ACL Assignment Account Emily has DC Sync permission: Domain and can steal all the passwords: Account Emily has Reset Password permission: on Administrator account Administrator account:
  • 14. Shadow Admins: Underground Accounts That Undermine The Network Privilege Escalation The Red Side Scenarios Persistence
  • 15. Shadow Admins: Underground Accounts That Undermine The Network C: NET LOCALGROUP _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ * Administrators ** Load and unload device drivers ** Manage Auditing and security logs * Remote Desktop Users ** Allow logon through remote desktop services User Rights - Local Privileged Accounts
  • 16. WATCH THE USER RIGHTS
  • 17. Shadow Admins: Underground Accounts That Undermine The Network Local User Rights
  • 18. Shadow Admins: Underground Accounts That Undermine The Network User Rights Attack
  • 19. Shadow Admins: Underground Accounts That Undermine The Network Our Free Tool - ACLight - Shadow Admin Scanner PowerShell GitHub Automatic
  • 21. Shadow Admins: Underground Accounts That Undermine The Network Privilege ACL Scanner - Results
  • 22. Shadow Admins: Underground Accounts That Undermine The Network Privilege ACL Scanner - Results Full CSV output – every account and its privileged permission:
  • 23. Shadow Admins: Underground Accounts That Undermine The Network Light In The Shadows Domain Groups Shadow Admins Local Groups
  • 24. Shadow Admins: Underground Accounts That Undermine The Network Download & Run Free: https://github.com/CyberArkLabs/ACLight Lavi.Lazarovitz@cyberark.com, @LaviLazarovitz Asaf.Hecht@cyberark.com, @Hechtov
  • 25. Shadow Admins: Underground Accounts That Undermine The Network Actionable Takeaways KNOW all your privileged accounts in the network: • By group assignments • By ACLs analysis of the Active Directory HOW: • Scan your network for Shadow Admins - who have sensitive direct permissions • Use our free privileged ACLs scanning tool: https://github.com/CyberArkLabs/ACLight SECURE those new detected privileged accounts!