CTD-000067

AD domain with bulk changes of computers

Medium
Active Directory
Impact
v9

Signature Identity

CTD-000067
Threat ID
9
Version
IOC
Indicator Type

Threat Description

Bulk changes might be a result of threat activities. Also, it could be a mistake. Deletions or modifications of AD objects can lead to service outages.

NOTE: This threat rule includes a built-in lookback parameter set to 25 hours. Only events that occurred within this timeframe are processed by the rule.

MITRE ATT&CK: Attack Tactics

Impact

D3FEND: Defend Tactics

User Account Permissions

Remediation

To rollback unwanted changes:
  1. Go to Change History.
  2. Select unwanted changes.
  3. Roll them back.

Frequently Asked Questions

What does AD domain with bulk changes of computers mean?

AD domain with bulk changes of computers refers to multiple concurrent changes made to Active Directory objects within a short period. These changes could be legitimate administrative actions or unauthorized modifications, such as deletions or attribute updates.

AD domain with bulk changes of computers is rated medium severity because it may indicate a security issue. If these changes are malicious, they could lead to service disruptions or compromise the integrity of the Active Directory environment by allowing attackers to modify permissions and access sensitive information.

An attacker who makes unauthorized modifications to AD objects through bulk changes may be able to disrupt services, gain unauthorized access to the domain, and even create new accounts or modify permissions to escalate privileges. The impact could be significant, affecting multiple systems and users within the organization.

Cayosoft Guardian continuously monitors Active Directory for unusual activity, including bulk changes to objects. When such changes are detected, Guardian flags them as a potential security issue, providing administrators with visibility into the changes and enabling prompt investigation.

Cayosoft Guardian helps reduce the risk by alerting administrators to potential security issues, allowing them to investigate and roll back unwanted changes. This proactive approach limits the impact of malicious activities and ensures the integrity of the Active Directory environment.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Classification
Systems
Active Directory
Themes
Account protection
Attack Tactics
Impact
Defend Tactics
User Account Permissions
Indicator Types
IOC
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical