AD user added to privileged group
Attackers can escalate privileges and access sensitive data through unauthorized access when a user is added to a privileged Active Directory group.
Active Directory detect dormant accounts for computers and users
Detecting dormant user and computer accounts in Active Directory helps prevent unauthorized access via stale credentials.
Folder on SYSVOL with non-default access permissions
SYSVOL folder with non-standard access permissions exposes sensitive information to unauthorized users.
AD domain with unsecure ESX authentication bypass
VMware ESXi host with unsecure AD authentication exposes attackers to exploit a vulnerability, bypassing access controls and gaining control over the system.
AD forest with recent changes to default security descriptor in schema
Active Directory schema modifications expose attack paths and persistence risks.
AD domain with bulk changes of users
Active Directory bulk user changes can indicate unauthorized access or administrative errors, potentially leading to service disruptions through lateral movement or privilege escalation.
AD domain with multiple failed authentication attempts via process
Multiple failed authentication attempts via process in an Active Directory domain expose attack paths and allow attackers to obtain initial access or elevate privileges.
Short-lived privileged AD object
Elevated permissions can be temporarily gained through short-lived privileged AD objects, exposing sensitive resources to unauthorized access.
Stale administrative account in AD domain
A stale administrative account in Active Directory exposes elevated privileges and cached credentials, enabling potential privilege escalation and reconnaissance.
AD domain controller with SMB1 enabled
A domain controller with SMB1 enabled exposes a high-risk vulnerability that attackers can exploit for remote code execution via the SMBv1 protocol, allowing lateral movement and privilege escalation within the domain.