Finding Our Path: How We're Trying to Improve Active Directory Security

on YouTube ↗45m

" summary

BloodHound maps Active Directory into graph problems and the team shows concrete results: data collection by SharpHound takes about 48 hours in a large environment and immediately surfaces a path that traverses seven domains to reach forest root. Tools used include SharpHound and Rubeus to modify msDs-AllowedToActOnBehalfOfOtherIdentity ACLs and forge Kerberos tickets, then DCsync to harvest krbtgt. One cited network of ~8,000 hosts yields ~20,346,385 shortest attack paths; simulated remediations cut exposure from 100% to 82%.

AI-written summary · about

" chapters (43)

1. 0:00Introduction
2. 0:50Welcome
3. 1:25Background
4. 1:38Prior Work
5. 1:56What is Bloodhound
6. 2:27Problem Solving
7. 3:11Two APIs
8. 3:23NetSession enum
9. 3:57NetLocalGroup enum
10. 4:25Matt Nelson
11. 7:19The New Way
12. 7:59Running Sharp Out
13. 8:52Bloodhound
14. 10:11Kerberos
15. 10:46Why is delegation needed
16. 11:30Resourcebased constrained delegation
17. 12:14Why does this matter
18. 13:14What does that mean in English
19. 13:30Bloodhound interface
20. 14:53Verify ACLs
21. 19:32DC Sync
22. 21:44What are we trying to do
23. 22:15John Lambert quote
24. 22:39Methodology
25. 23:13Objective
26. 23:30Privileges
27. 27:43Kerberos Sting
28. 28:59LowHanging Fruit
29. 29:46What about this
30. 30:40Objectives
31. 31:31Shortest Paths
32. 33:07All Attack Paths
33. 36:08Its extremely complicated
34. 36:20The shortest path
35. 37:13Analyzing all paths
36. 37:34Analyzing domain admins
37. 38:01Analyzing GPOs
38. 40:41Abusable ACLs
39. 41:08Inbound Object Control
40. 42:05Real Numbers
41. 42:16Whats Possible
42. 43:57Free and Open Source
43. 44:28Questions

" related talks

• 26mBreaking the Attack Graph: How to Leverage Graphs to Strengthen Security in a Domain EnvironmentMarina Simakov · Black Hat Asia 2018
• 50mBeyond the Mcse: Active Directory for the Security ProfessionalSean Metcalf · Black Hat USA 2016
• 50mHybrid Active Directory Attacks: Anatomy and DefensesDerek Melber · RSA Conference 2023
• 37mThreat Hunting in Active Directory EnvironmentAnurag Khanna, Thirumalai Natarajan Muthiah · Black Hat Asia 2021
• 40mTop Active Directory Attacks: Understand, then Prevent and DetectJeff McJunkin · RSAC 2021
• 45mHacking HeuristicsKelly Villanueva · NorthSec 2019
• 53mThe Importance of Identity-Centric Security in 2024Vivin Sathyan · RSA Conference 2024
• 32mRansomware, Risk, & Recovery: Protecting and Creating Resilience for Hybrid Active DirectoryCalum Field · 34th Annual FIRST Conference 2022