Read-Only Domain Controller (RODC) in Inconsistent State
Inconsistent Read-Only Domain Controllers (RODCs) expose authentication and authorization vulnerabilities, allowing attackers to exploit outdated or incorrect credentials.
Device enrolled in Intune but never synced
Devices enrolled in Intune but never synced expose organizations to attack paths through persistence and reconnaissance, highlighting the need for continuous compliance checks.
AD-integrated DNS zone with WINS forward lookup enabled
AD-integrated DNS zones with WINS forward lookup enabled expose users to forged DNS responses that can compromise account authentication, enabling attackers to bypass authentication or steal credentials.
External trust without SID filtering enabled
External trusts without SID filtering enabled expose Active Directory to spoofed Security Identifiers (SIDs) in access requests, allowing attackers to gain unauthorized access.
Active Directory password in Group Policy Preferences (GPP) compromise
Active Directory password exposure in Group Policy Preferences (GPP) XML files allows attackers to decrypt passwords and access privileged accounts or systems.
Regular AD object with Migrate SID history permission
Attackers can migrate high-privilege SIDs into their own accounts via a regular AD object with Migrate SID history permission, gaining elevated access and privileges.
AD domain with restored domain controllers
Attackers can modify user account access and evade detection through restored domain controllers in Active Directory, allowing unauthorized password resets or group membership modifications.
AD forest with Java schema extension
Active Directory forests with Java schema extensions are exposed to malicious code injection through extended attributes, enabling attackers to escalate privileges and execute arbitrary commands.
Microsoft Entra tenant with unsecure app consent policy configuration
A tenant policy allowing any user to grant app access without admin consent exposes users to consent phishing via unsecured app permissions.
Computer with unsupported OS version in AD domain
Outdated OS versions in AD domains expose systems to security vulnerabilities, enabling attackers to exploit unpatched weaknesses.