Stale Microsoft Entra guest account
Stale Microsoft Entra guest accounts expose your Entra ID tenant to information collection by attackers through inactive user accounts.
Microsoft Entra tenant with recent changes in Cross Tenant Access configuration
Unauthorized access or privilege escalation risk due to misconfigured Entra cross-tenant access synchronization.
Entra ID application owner attribute populated with a hybrid user account
A hybrid user account set as Entra ID application owner attribute may lead to unauthorized access and privilege escalation through compromised credentials or exploited permissions.
Service principal promoted to privileged role via OAuth consent attack
Attackers exploit OAuth consent to promote malicious service principals, enabling long-term persistence in Entra ID. Cayosoft Guardian detects and mitigates this threat by monitoring OAuth consent logs and service principal permissions.
Insufficient forest and domain functional levels
A low forest and domain functional level exposes your Active Directory environment to critical vulnerabilities, making it easier for attackers to exploit deprecated protocols and escalate privileges.
AD Domain with executable files in SYSVOL
Executable files in SYSVOL may be infected, enabling attackers to maintain persistence through Active Directory forest recovery.
Folder on SYSVOL with non-default access permissions
SYSVOL folder with non-standard access permissions exposes sensitive information to unauthorized users.
AD domain with unsecure ESX authentication bypass
VMware ESXi host with unsecure AD authentication exposes attackers to exploit a vulnerability, bypassing access controls and gaining control over the system.
Missing Conditional Access Policy for requiring compliant devices in Entra ID
A missing Conditional Access Policy in Entra ID exposes corporate resources to non-compliant devices, enabling unauthorized access and malicious actions.
Microsoft Entra user not registered with MFA
Microsoft Entra user accounts without MFA are exposed to unauthorized access due to lack of identity verification, enabling attackers to gain access through password guessing or theft.