Active Directory Certificate Services auditing not configured
Unconfigured Active Directory Certificate Services (AD CS) auditing increases risk of privilege escalation, credential theft, and persistence due to undetected certificate operations.
Windows LAPS not configured or AD prerequisites missing
Exposure to static or reused local administrator passwords increases risk of credential reuse and lateral movement due to missing Windows LAPS configuration or incomplete Active Directory prerequisites.
AD user has a password that matches its sAMAccountName
Predictable password pattern in Active Directory exposes users to brute-force attacks, compromising account security and allowing unauthorized access.
Constrained authentication delegation to a domain controller service
Constrained authentication delegation to a domain controller service exposes sensitive resources to exploitation via Kerberos protocol vulnerabilities.
AD Delegated Managed Service Account (dMSA) object takeover by computer object
Attackers exploit dMSA delegation in Active Directory, gaining write access and escalating privileges through computer object impersonation, allowing them to modify sensitive objects and maintain persistence.
AD computer with suspicious change of sAMAccountName
A suspicious sAMAccountName change on an AD computer can enable attackers to escalate privileges, compromising domain security through attack paths that exploit administrative scope and credentials.
Microsoft Entra cloud-only user with immutable ID set
Attackers can exploit a Microsoft Entra cloud-only user with an immutable ID set to gain direct access to sensitive data and systems, bypassing normal authentication and authorization controls.
AD domain with multiple failed authentication attempts from invalid users via NTLM
Multiple failed NTLM authentication attempts from invalid users in an Active Directory domain may indicate a Password Spraying attack, exposing the environment to potential reconnaissance and privilege escalation.
AD domain with multiple failed authentication attempts via Kerberos
Multiple failed Kerberos authentications against an AD domain expose users to password guessing attacks, enabling attackers to plan and execute a targeted attack.
AD domain with multiple failed remote authentication attempts
Multiple failed remote authentication attempts against an Active Directory domain may indicate a potential Password Spraying attack, which can be mitigated by Cayosoft Guardian’s detection and alerting capabilities.