AD account configured or modified to use RC4 encryption
Active Directory accounts using RC4 encryption are vulnerable to password cracking and forged Kerberos tickets, enabling lateral movement and data breach.
Active Directory SMB signing not enforced on domain controller
Active Directory SMB signing not enforced on domain controllers exposes SMB traffic to tampering and relay-style attacks, enabling attackers to bypass authentication and access sensitive data.
Insecure ACLs on Service Connection Points in Active Directory
Insecure ACLs on Service Connection Points in Active Directory expose sensitive data and enable man-in-the-middle attacks through unauthorized attribute modifications.
Active Directory SMB signing not enforced on domain controller
Microsoft Entra tenant where regular users can register applications
High-risk exposure in Microsoft Entra tenant where regular users can register applications, enabling attackers to expand their reach and gain persistence.
The certificate template has a key length of less than 2048 bits
A certificate template with a key length of less than 2048 bits exposes the organization to high-risk cryptographic vulnerabilities, enabling attackers to exploit weaknesses in random number generation and side-channel attacks.
Privileged AD user account with associated SPNs
Attackers can exploit Privileged AD user accounts with associated SPNs for lateral movement and credential access due to elevated privileges and Kerberos Service Ticket capabilities.
AD Krbtgt account password was not reset recently
Active Directory (AD) is exposed to potential golden ticket and pass-the-hash attacks due to an unchanged Kerberos ticket-granting service account password.
Privileged Microsoft Entra account synced from on-premise
Attackers can access Microsoft Entra resources with elevated permissions due to direct membership in administrative roles from a compromised on-premises account synced from Active Directory.
Microsoft Entra tenant with recent changes in Cross Tenant Access configuration
Unauthorized access or privilege escalation risk due to misconfigured Entra cross-tenant access synchronization.