Active Directory Attacks: A Catalog of AD Security Risks and Techniques
Filter by:
195 results
Check for completeness of network declaration
MITRE: Mitigation
Technique: Active Directory Configuration
Technique ID: M1015
AD objects
Check if all accounts require Kerberos pre-authentication
MITRE: Credential Access
Technique: Steal or Forge Kerberos Tickets
Subtechnique: AS-REP Roasting
Technique ID: T1558.004
AD objects
Check if the guest account is enabled
MITRE: Persistence , Privilege Escalation , Initial Access
Technique: Valid Accounts: Local Accounts
Technique ID: T1078.003
AD objects
Computers with old password last set date
MITRE: Credential Access
Technique: Account Manipulation
Technique ID: T1098
AD objects
Computers with SERVER_TRUST_ACCOUNT enabled
MITRE: Privilege Escalation , Domain Persistence
Technique: Domain Controller Authentication
Technique ID: T1207
AD objects
Disabled members
MITRE: Discovery , Privilege Escalation , Persistence , Defense Evasion
AD objects
Duplicate account check
MITRE: Mitigation
Technique: Active Directory Configuration
Technique ID: M1015
AD objects
Inactive computer check
MITRE: Mitigation
Technique: User Account Management
Technique ID: M1018
AD objects
Kerberos krbtgt account with old password
MITRE: Credential Access , Privilege Escalation
Technique: Steal or Forge Kerberos Tickets
Technique ID: T1558
AD objects
Objects created (Past 7 Days)
MITRE: Persistence , Privilege Escalation
Technique: Create Account
Subtechnique: T1136.002 Domain Account
Technique ID: T1136
AD objects
Old password (over 180 days)
MITRE: Discovery , Credential Access
Technique: Brute Force, Credential Dumping
Technique ID: T1110, T1003
AD objects
Principals with non-default Primary Group IDs
MITRE: Persistence , Privilege Escalation
Technique: Account Manipulation
Technique ID: T1098
AD objects