Todos los checks que ejecuta ADscan, mapeados a MITRE ATT&CK.

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1133 External Remote Services

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1190 Exploit Public-Facing Application

Permissions

The User-Force-Change-Password extended right in Active Directory allows a principal to reset another user's password without knowing the current password.

T1098 Account Manipulation

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1136 Create Account

CVE

NoPac chains two Active Directory vulnerabilities to achieve domain compromise from any standard domain user account.

T1068 Exploitation for Privilege Escalation

Authentication

If the Domain Controller authenticates back using NTLMv1 during a coerced callback, the environment still permits a legacy NTLM mode with materially weaker cryptographic protections.

T1078 Valid Accounts

Privilege

Domain Administrator sessions were discovered on workstations, member servers, or other non-Tier 0 hosts.

T1078.002 Domain Accounts

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1027 Obfuscated Files or Information

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1070 Indicator Removal

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1556.007 Hybrid Identity

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1003 OS Credential Dumping

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1003.001 LSASS Memory

Active Directory

The DCSync attack exploits Active Directory's directory replication protocol (MS-DRSR) to simulate the behavior of a Domain Controller requesting credential replication.

T1003.006 DCSync

Posture/Hygiene

One or more domain-joined hosts do not have a managed local administrator password solution deployed.

T1078.003 Valid Accounts: Local Accounts

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1110.001 Password Guessing

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1110.003 Password Spraying

Delegation

Resource-Based Constrained Delegation (RBCD) is a Kerberos mechanism configured via the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on computer objects that controls which principals may impersonate users to that computer.

T1134.001 Access Token Manipulation: Token Impersonation/Theft

CVE

WebDAV (Web Distributed Authoring and Versioning) support is enabled on detected hosts via the Windows WebClient service.

T1187 Forced Authentication

CVE

Zerologon (CVE-2020-1472, CVSS 10.0) is a cryptographic flaw in the Netlogon Remote Protocol (MS-NRPC) that allows an unauthenticated attacker to forge a valid Netlogon session with a Domain Controller.

T1210 Exploitation of Remote Services

SMB

Files accessible over SMB shares were found to contain sensitive data such as plaintext credentials, API keys, private keys, or configuration artifacts that include authentication material.

T1552.001 Credentials in Files

GPP

Group Policy Preferences (GPP) support autologin configurations that store credentials in XML policy files under the SYSVOL share on Domain Controllers.

T1552.006 Group Policy Preferences

LAPS

The Local Administrator Password Solution (LAPS) stores per-machine local administrator credentials in the ms-Mcs-AdmPwd attribute of computer objects in Active Directory.

T1555 Credentials from Password Stores

LDAP

When Domain Controllers do not require LDAP signing or do not enforce channel binding, attackers can relay coerced or captured NTLM authentication to LDAP and perform directory operations in the victim context.

T1557 Adversary-in-the-Middle

LDAP

When Domain Controllers do not require LDAP signing or do not enforce channel binding, attackers can relay coerced or captured NTLM authentication to LDAP and perform directory operations in the victim context.

T1557.001 LLMNR/NBT-NS Poisoning + SMB Relay

CVE

NoPac chains two Active Directory vulnerabilities to achieve domain compromise from any standard domain user account.

T1558 Steal or Forge Kerberos Tickets

Privilege

The KRBTGT account is the built-in service account used by the Kerberos Distribution Center (KDC) to encrypt and sign all Kerberos Ticket-Granting Tickets (TGTs) issued in the domain.

T1558.001 Steal or Forge Kerberos Tickets: Golden Ticket

Kerberos

In an Active Directory (AD) environment, Service Principal Names (SPNs) are used to uniquely identify instances of a Windows service.

T1558.003 Kerberoasting

Kerberos

Preauthentication offers protection against offline Password Cracking.

T1558.004 AS-REP Roasting

Credential Access

One or more Active Directory objects have existing msDS-KeyCredentialLink attribute values.

T1606.002 Forge Web Credentials: SAML Tokens

ADCS

ADCS ESC1 occurs when a certificate template is configured to allow requesters to specify a Subject Alternative Name (SAN) in their certificate request, combined with an authentication-capable Extended Key Usage (EKU) such as Client Authentication, Smart Card Logon, or PKINIT.

T1649 Steal or Forge Authentication Certificates

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1018 Remote System Discovery

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1069 Permission Groups Discovery

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1087 Account Discovery

LDAP

Lightweight Directory Access Protocol (LDAP) supports anonymous bind operations, which permit unauthenticated clients to connect and query directory information from a Domain Controller without presenting any credentials.

T1087.002 Account Discovery: Domain Account

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1482 Domain Trust Discovery

Credential Exposure

Credential material (passwords, tokens, or similar secrets) was detected in cleartext LDAP attributes such as description, info, unixUserPassword, or userPassword.

Kerberos Security

The krbtgt account password has not been changed in more than 180 days.

Domain Configuration

The ms-DS-MachineAccountQuota attribute is set to a value greater than 0.

Asset Hygiene

One or more domain-joined systems appear to be running obsolete Windows versions identified through LDAP inventory.

Kerberos Security

One or more accounts do not have AES encryption types configured (msDS-SupportedEncryptionTypes bits 2-4 are all zero).

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1021.001 Remote Services: RDP

SMB

One or more hosts accepted SMB guest session authentication and exposed accessible shares.

T1021.002 Remote Services: SMB/Windows Admin Shares

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1550.002 Pass the Hash

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1550.003 Pass the Ticket

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1570 Lateral Tool Transfer

ATT&CK technique surfaced by ADscan in the kill-chain heatmap and coverage matrix when observed in the target domain.

T1486 Data Encrypted for Impact