Microsoft Entra application registration with dangling URI
Attackers can exploit dangling Microsoft Entra application registration URIs to obtain user sessions’ authorization tokens, enabling lateral movement or privilege escalation.
Stale Microsoft Entra service principal
A stale Microsoft Entra service principal can lead to unauthorized access and data breaches if not properly managed, exposing your organization to attack paths through compromised credentials and permissions.
AD domain with misconfigured LDAP signing policy on the domain controllers
A misconfigured LDAP signing policy on Active Directory domain controllers exposes the environment to man-in-the-middle attacks, allowing attackers to intercept authentication traffic.
Active Directory missing KDS root key required for gMSA support
Active Directory missing KDS root key required for gMSA support exposes services to weak or stale credentials due to reliance on traditional accounts, enabling attackers to exploit Kerberos authentication and escalate privileges.
AD domain with misconfigured UNC paths policies
Active Directory misconfigurations expose authentication traffic, allowing attackers to intercept credentials or impersonate domain controllers via NTLM relay and SMB downgrade vulnerabilities.
Insufficient Active Directory domain controller auditing policy configuration
A missing or inadequate Active Directory domain controller auditing policy configuration exposes your environment to lateral movement attacks.
AD domain allows unprivileged users to add computer accounts
Attackers can exploit AD domain settings to create legitimate-looking computer accounts for non-existent devices, enabling them to bypass security controls and gain unauthorized access.
AD domain with unsecure RBCD delegation on domain controllers
Attackers can impersonate any user via unsecure Resource-Based Constrained Delegation (RBCD) on domain controllers, enabling unauthorized access to sensitive resources and data.
Exchange-related AD group with excessive permissions
Attackers exploiting Exchange-related AD group with excessive permissions can reset passwords, add accounts to sensitive groups, or modify ACLs due to assigned FullControl, WriteDACL, ForceChangePassword, or AddMember permissions.
AD domain controller using unsecure encryption type
Domain controllers using outdated or insecure encryption types expose sensitive data to attackers, enabling privilege escalation and credential access through Kerberos protocol exploitation.