CTD-000029

Computer with unsupported OS version in AD domain

Medium
Active Directory
Lateral Movement Persistence
v76

Signature Identity

CTD-000029
Threat ID
76
Version
IOE
Indicator Type

Threat Description

A computer with an unsupported operating system version poses a threat to your Active Directory environment. A threat actor might specifically target computers running unsupported OS versions, as they might have unpatched vulnerabilities.

MITRE ATT&CK: Attack Tactics

Lateral Movement Persistence

D3FEND: Defend Tactics

Domain Account Monitoring

Remediation

Frequently Asked Questions

What does Computer with unsupported OS version in AD domain mean?

Computer with unsupported OS version in AD domain refers to computers within the Active Directory environment (AD) domain running an operating system version that is no longer supported by its vendor. This can lead to unpatched security vulnerabilities, making these systems susceptible to exploitation.

An unsupported operating system can be exploited by attackers to gain unauthorized access or escalate privileges, providing a foothold for lateral movement and persistence. Although the vulnerability itself does not grant administrative control, it increases the attacker's capability to move undetected within the Active Directory environment.

Attackers can exploit computers with outdated operating system versions to gain unauthorized access or escalate privileges. They might target these systems specifically due to the potential for unpatched vulnerabilities, which could be used to launch further attacks within the Active Directory environment.

Cayosoft Guardian detects computers with outdated operating system versions by continuously monitoring the operating systems of all computers within the Active Directory environment domain. When an unsupported OS is detected, Guardian flags it as a security issue so administrators can take corrective action.

Cayosoft Guardian helps reduce the risk by alerting administrators to upgrade or remove computers running outdated operating systems from the Active Directory environment domain. This proactive approach limits the potential for exploitation and reduces the blast radius of a successful attack.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Classification
Systems
Active Directory
Themes
Infrastructure
Attack Tactics
Lateral Movement Persistence
Defend Tactics
Domain Account Monitoring
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical