Tenable Identity Exposure allows you to secure your infrastructure by anticipating threats, detecting breaches, and responding to incidents and attacks. Using an intuitive dashboard to monitor your Active Directory in real-time, you can identify at a glance the most critical vulnerabilities and their recommended courses of remediation. Tenable Identity Exposure’s Indicators of Attack and Indicators of Exposure allow you to discover underlying issues affecting your Active Directory, identify dangerous trust relationships, and analyze in-depth details of attacks.
>> https://www.tenable.com/indicators
Indicators of Attack
Critical Severity
- Suspicious DC Password Change: Exploits Netlogon vulnerability to change domain controller passwords.
- Zerologon Exploitation: Compromises domain controllers via CVE-2020-1472.
- DPAPI Domain Backup Key Extraction: Extracts keys critical for DPAPI secrets.
- NTDS Extraction: Exfiltrates the NTDS.dit database for offline password cracking.
- PetitPotam: Coerces authentication for NTLM relay attacks.
- DCShadow: Registers rogue domain controllers to push changes via replication.
- OS Credential Dumping: LSASS Memory: Accesses credential material stored in LSASS.
- Golden Ticket: Uses KRBTGT account to create valid Kerberos tickets.
- DCSync: Simulates a domain controller to retrieve password hashes.
High Severity
- DnsAdmins Exploitation: Allows DNSAdmins group members to control Domain Controllers.
- SAMAccountName Impersonation: Elevates privileges via flawed handling of sAMAccountName attributes.
Medium Severity
- Unauthenticated Kerberoasting: Targets Active Directory service account credentials for offline cracking.
- Kerberoasting: Similar to unauthenticated Kerberoasting, requires Honey Account feature.
- Password Spraying: Attempts to access multiple accounts with common passwords.
- Password Guessing: Uses brute-force methods to guess passwords.
Low Severity
- Massive Computers Reconnaissance: Detects massive authentication requests indicating potential attacks.
- Enumeration of Local Administrators: Enumerates local Administrators group via SAMR RPC interface.
Indicators of Exposure
Critical Severity
- Known Federated Domain Backdoor: Exploitation of federated domains for persistence and privilege escalation.
- Risky Service Principal Permissions: Dangerous permissions granted to service principals.
- Non-Privileged Account Without MFA: Lack of MFA on accounts exposes them to breaches.
High Severity
- Privileged Entra Account Synchronized With AD (Hybrid): Hybrid accounts pose risks due to potential AD compromise.
- First-Party Service Principal With Credentials: Attackers add credentials to powerful, hidden service principals.
- Dangerous API Permissions Affecting the Tenant: Certain API permissions pose threats to the tenant.
- Privilege Escalation Through OAuth Applications: Exploiting OAuth apps for privilege escalation.
- Unmanaged Devices with Access: Devices not managed by MDM but have access pose risks.
- Privileged Account with No Password Policy: Privileged accounts lacking password policies are vulnerable.
- Password Hash Sync: Synchronizing password hashes poses risks.
- Admin Accounts Without Recent Sign-Ins: Dormant admin accounts can be exploited.
- Risky Sign-In Locations: Unusual sign-in locations for admin accounts.
- Deprecated Protocols: Use of deprecated protocols for authentication.
Medium Severity
- Excessive Permissions for Service Accounts: Service accounts with unnecessary permissions.
- Long-lived Refresh Tokens: Tokens that don’t expire are risky.
- Non-Compliant Devices: Devices that don’t comply with security policies.
- Exposed Service Principal Credentials: Credentials of service principals exposed.
- Excessive Logins by Single Account: Indicates potential brute-force attacks.
- Suspicious App Consents: Consents to apps that request excessive permissions.
- Admin Accounts Without Conditional Access: Lack of conditional access policies.
- High-Risk Sign-Ins: Sign-ins flagged as high-risk.
- Suspicious Inbox Rules: Malicious rules set up in user inboxes.
Low Severity
- Inactive Users with Licenses: Licenses assigned to inactive users.
- Non-Privileged Accounts Without MFA: Regular accounts lacking MFA.
- Service Accounts Without Login Activity: Service accounts with no recent activity.
- Shared Accounts: Accounts shared by multiple users.
- Generic Names for Admin Accounts: Generic account names can be targeted.
- Unverified Applications: Applications not verified by Microsoft.
- External Forwarding Rules: Forwarding rules to external addresses.
- Guest Accounts with Admin Privileges: Guest accounts granted admin roles.
- SPNs Without Service Principal Owner: Service Principal Names lacking owners.
- Accounts with Password Set to Never Expire: Such accounts are susceptible to breaches.
- Risky Delegated Permissions: Delegated permissions that pose risks.
- Azure AD Connect Sync Failures: Failures in syncing with Azure AD.
- Unused Privileged Roles: Unused roles that should be removed.
- Unsupported Browsers: Use of browsers that are no longer supported.
- Suspicious Sign-In IP Addresses: IP addresses flagged for suspicious activity.
- Excessive Number of Tokens Issued: High number of tokens could indicate an attack.
- Accounts with Weak Passwords: Accounts not following strong password policies.
- Suspicious Service Principal Activity: Unusual activity detected.
- Unmanaged Devices Without Conditional Access: Such devices are at risk.
- External Users with Permissions: External users granted permissions.
- Non-Compliant Applications: Applications not complying with security policies.
- Expired Certificates: Certificates that have expired and need renewal.
- Service Principals with Delegated Admin Privileges: Such privileges pose risks.
- Long-Lasting Access Tokens: Tokens with long durations are risky.
- Missing Conditional Access Policies: Lack of conditional access policies.
- Inactive Users: Users who have not logged in recently.
- Unused Applications: Applications that are not in use.
- Service Principal Names with High Privileges: SPNs granted high privileges.
- Inactive Conditional Access Policies: Policies that are no longer active.
- Risky Sign-In Attempts: Attempts flagged as risky.
- Multiple Failed Sign-In Attempts: Indicates potential attacks.
- Devices Without Endpoint Protection: Devices lacking proper protection.
- Accounts Without Recovery Options: Accounts that lack recovery options.