AD user has a password that matches its sAMAccountName
Predictable password pattern in Active Directory exposes users to brute-force attacks, compromising account security and allowing unauthorized access.
Microsoft Entra tenant with partner access via Delegated Administrative Privileges
A Microsoft Entra tenant configured for partner access through Delegated Administrative Privileges exposes sensitive resources to potential unauthorized access and lateral movement.
AD domain with multiple failed authentication attempts from invalid users via NTLM
Multiple failed NTLM authentication attempts from invalid users in an Active Directory domain may indicate a Password Spraying attack, exposing the environment to potential reconnaissance and privilege escalation.
AD domain with multiple failed authentication attempts via Kerberos
Multiple failed Kerberos authentications against an AD domain expose users to password guessing attacks, enabling attackers to plan and execute a targeted attack.
AD domain with multiple failed remote authentication attempts
Multiple failed remote authentication attempts against an Active Directory domain may indicate a potential Password Spraying attack, which can be mitigated by Cayosoft Guardian’s detection and alerting capabilities.
AD domain with multiple failed authentication attempts by non-existing users using Kerberos
Multiple failed Kerberos authentication attempts by non-existent users indicate a potential password spraying attack, exposing credentials and permissions.
Device enrolled in Intune but never synced
Devices enrolled in Intune but never synced expose organizations to attack paths through persistence and reconnaissance, highlighting the need for continuous compliance checks.
Microsoft Entra guest account with unredeemed invite
Unredeemed Microsoft Entra guest account invitations can be exploited by attackers to create persistence, increasing risk of credential exposure through authentication and authorization mechanisms.
Regular Microsoft Entra user with Exchange Online PowerShell enabled
A non-administrative Microsoft Entra user with Exchange Online PowerShell enabled expands remote mailbox automation access if the account is compromised, increasing exposure to attack paths.
AD user with identical password
Attackers can access multiple AD user accounts with identical passwords without additional authentication efforts, increasing exposure and attack paths.