Lateral Movement with CrackMapExec

Lateral Movement with CrackMapExec

In the previous post, we explored how attackers can use Mimikatz to automatically escalate privileges to Domain Admins using Empire and DeathStar. In this post, I will take a look at another open-source tool that leverages Mimikatz to harvest credentials and move laterally through an Active Directory environment: CrackMapExec. Self-described as a “swiss army knife for pentesting networks”, CrackMapExec is a Python-based utility that is geared towards evaluating and exploiting weaknesses in Active Directory security. This approach involves gathering credentials…

Read More Read More

Active Directory Permissions Attacks – Insider Threat Podcast #4

Active Directory Permissions Attacks – Insider Threat Podcast #4

In our fourth edition of the Insider Threat podcast, we have our favorite guest Jeff Warren on to discuss the latest in the AD attack series of blog posts. These attacks are always fascinating, but this one must be the most interesting yet. These attack vectors are simultaneously obscure and powerful. Most attackers aren’t sophisticated enough to leverage AD permissions in these ways, but those that are rank as the most dangerous. We started with a simple definition of what…

Read More Read More

Market Trends: NYCRR 500

Market Trends: NYCRR 500

The New York State Department of Financial Services (DFS) new cybersecurity standard, New York Code Rules and Regulations 500 (NYCRR 500), extends past New York state limits to “subsidiaries or affiliates”. This regulation mandates each institution have a cyber security program, Chief Information Security Officer (CISO), access controls, asset management, data governance, software development practices, annual certification of their compliance, and more. As far as regulatory compliance standards, NYCRR 500 is one of the most well written regulations. Many other…

Read More Read More

STEALTHbits ProTip: 23 NYCRR 500

STEALTHbits ProTip: 23 NYCRR 500

While we here at STEALTHbits can’t help our customers with the personal part of 23 NYCRR 500, we can make it easy to identify the reports that help with Section 500’s access and activity pieces. Starting with version StealthAUDIT v8.0 we’ve introduced report tagging, allowing you to easily organize the reports that are important to you.  These can be named as desired, typically by their associated compliance standard.  For this month’s ProTip I’ll be using the tag, ’23NYCRR500′. First, we…

Read More Read More

The Value of the Active Directory Attack Blog Series

The Value of the Active Directory Attack Blog Series

Active Directory Attack Blog Series Spending time with customers in Texas last week left me speechless – literally. One customer asked me a question for which I was not prepared. They have been following our Active Directory attack blog series. They found it very interesting, but they had one major question. Why should they spend so much time thinking about what attackers do? If they spend all your time creating good security programs and practices, isn’t that the best they…

Read More Read More

Understanding the Impact of NYCRR 500

Understanding the Impact of NYCRR 500

In our third edition of the Insider Threat podcast, we turn from the bad guys attacking you to auditors attacking you. That’s a joke, but I know it does reflect the way it can feel sometimes. Many folks will ignore NYCRR 500 because they see “NYC” and think that means it isn’t about them, or they know it is being put out there by the New York State Department of Financial Services (DFS) and think that means it will not…

Read More Read More

How Attackers are Stealing Your Credentials with Mimikatz

How Attackers are Stealing Your Credentials with Mimikatz

Stealing Credentials with Mimikatz Mimikatz is an open-source tool built to gather and exploit Windows credentials. Since its introduction in 2011 by author Benjamin Delpy, the attacks that Mimikatz is capable of have continued to grow. Also, the ways in which Mimikatz can be packaged and deployed have become even more creative and difficult to detect by security professionals. This has led to Mimikatz recently being tied to some of the most prevalent cyber attacks such as the Petya ransomware….

Read More Read More

Unlocking All the Doors to Active Directory with the Skeleton Key Attack

Unlocking All the Doors to Active Directory with the Skeleton Key Attack

Introduction: Unlocking Active Directory with the Skeleton Key Attack There are several methods for compromising Active Directory accounts that attackers can use to elevate privileges and create persistence once they have established themselves in your domain. The Skeleton Key is a particularly scary piece of malware targeted at Active Directory domains to make it alarmingly easy to hijack any account. This malware injects itself into LSASS and creates a master password that will work for any account in the domain….

Read More Read More

Manipulating User Passwords with Mimikatz

Manipulating User Passwords with Mimikatz

Introduction: Manipulating User Passwords with Mimikatz Mimikatz now supports the ability to manipulate user passwords with new commands: SetNTLM and ChangeNTLM. These commands give attackers a new way to change user passwords and escalate privileges within Active Directory. Let’s take a look at these NTLM commands and what they do. ChangeNTLM This performs a password change event. To use this command, you must know the old password in order to set a new one. One deviation is that this command…

Read More Read More