Privileged AD account password set to never expire
A privileged AD account with a non-expiring password exposes Active Directory resources to persistent attacker access until the password is changed.
AD user account with DES encryption type enabled
Active Directory user accounts using outdated DES encryption type are exposed to brute-force attacks, allowing unauthorized access.
Privileged AD object with permissions allowing takeover by regular user
A privileged Active Directory object with misconfigured permissions allows regular users to take control, exposing sensitive resources and escalating privileges.
AD domain account with unconstrained delegation
An AD domain account with unconstrained delegation exposes service credentials for unauthorized access, enabling attackers to escalate privileges.
DNS zone allowing unsecure update
A DNS zone allowing unsecure update enables attackers to modify records without authentication, exposing users to malicious servers via DNS spoofing and cache poisoning.
Privileged group members with weak password policy
Weak passwords in privileged group members expose accounts to authentication bypass, enabling attackers to gain unauthorized access.