AD domain with bulk changes of users

AD domain with bulk changes of users is rated medium severity because such changes indicate potential unauthorized access and lateral movement capabilities for attackers. However, deletions or modifications can still lead to service outages and disruptions.

Attackers may use bulk changes to user accounts for privilege escalation by creating a blast radius within the Active Directory environment. This also indicates potential persistence, lateral movement, and unauthorized access within the environment.

Cayosoft Guardian continuously monitors Active Directory for multiple simultaneous changes to user accounts, providing visibility into security issues when detected, allowing administrators to investigate and take corrective action.

Cayosoft Guardian reduces the risk by alerting administrators to investigate and roll back unwanted changes, containing malicious activity and minimizing service outages through its monitoring capabilities.