AD domain with non-default permissions on krbtgt account
A domain with non-default permissions on the krbtgt account exposes attackers to creating a Golden Ticket, granting unauthorized Kerberos authentication.
Microsoft Entra Global Administrator with elevated access to Azure Resources
Elevated Azure resource access by a Global Admin exposes sensitive data to potential attacks through unfiltered access.
Microsoft Entra app with risky write permissions
Microsoft Entra apps with write permissions expose your tenant to unauthorized modifications and data tampering.
AD user with compromised password
Attackers can exploit exposed password hashes in Active Directory user accounts, enabling unauthorized access and potential privilege escalation.
Privileged AD object with permissions allowing takeover by regular user
A privileged Active Directory object with misconfigured permissions allows regular users to take control, exposing sensitive resources and escalating privileges.
AD domain controller with enabled print spooler
A domain controller with enabled print spooler exposes domain credentials to remote connections, enabling attackers to compromise the domain controller or other systems through Kerberos authentication attacks.
AD domain account with unconstrained delegation
An AD domain account with unconstrained delegation exposes service credentials for unauthorized access, enabling attackers to escalate privileges.
Built-in domain Administrator account used recently
Built-in domain Administrator account usage indicates potential unauthorized access to high-privilege credentials, exposing the organization to attack paths through administrative scope and credential misuse.
DNS zone allowing unsecure update
A DNS zone allowing unsecure update enables attackers to modify records without authentication, exposing users to malicious servers via DNS spoofing and cache poisoning.
AD computer account that is a member of privileged groups
A compromised AD computer account in a privileged group enables persistent lateral movement within the domain.