Active Directory Security
Categories
- Active Directory Backup & Recovery (62)
- Active Directory Security (213)
- AD Security 101 (17)
- Community Tools (19)
- Directory Modernization (9)
- From the Front Lines (69)
- Hybrid Identity Protection (68)
- Identity Attack Catalog (27)
- Identity Threat Detection & Response (143)
- Our Mission: Be a Force for Good (14)
- Purple Knight (5)
- Semperis University (1)
- The CISO's Perspective (16)
- Threat Research (68)
How to Defend Against an Overpass the Hash Attack
- Daniel Petri | Senior Training Manager
In the constantly evolving landscape of cyber threats, the Overpass the Hash attack is a potent vector. Leveraging the NTLM authentication protocol, this attack enables adversaries to bypass the need for plaintext passwords. Instead, an Overpass the Hash attack employs a user's hash to authenticate and potentially escalate privileges. As…
Active Directory Hardening Best Practices
- Sean Deuby | Principal Technologist
According to Microsoft's most recent Digital Defense Report, nearly half of all Microsoft Incident Response engagements encountered unsecure Active Directory configurations. This corroborates a similar report from Mandiant that 9 of 10 cyberattacks exploit an Active Directory server. These sobering statistics are a reminder that organizations hoping to build a…
MFA for Active Directory: An Overview
- Sean Deuby | Principal Technologist
Modern information security is built on a layered defense. Each layer supports the others and presents additional obstacles to threat actors. From patch management to perimeter firewalls, each layer makes it more difficult for attackers to compromise your network. Multifactor authentication (MFA) is one of these layers. MFA has many…
Identity Attack Watch: AD Security News, January 2024
- Semperis Research Team
As cyberattacks targeting Active Directory continue to rise, AD security, identity, and IT teams face mounting pressure to monitor the evolving AD-focused threat landscape. To assist IT professionals in comprehending and preventing attacks that involve AD, the Semperis Research Team publishes a monthly roundup of recent cyberattacks. In this month’s…
How to Defend Against an NTLM Relay Attack
- Daniel Petri | Senior Training Manager
The NTLM relay attack poses a significant threat to organizations that use Active Directory. This attack exploits the NT LAN Manager (NTLM) authentication protocol, a challenge-response mechanism used in Windows networks for user authentication. NTLM relay attacks are not just a relic of past security concerns but a present and…
NSA Top Ten Cybersecurity Misconfigurations: An Active Directory Perspective (Part 3)
- Daniel Petri | Senior Training Manager
Welcome to the final installment of this series discussing CISA and NSA top ten cybersecurity misconfigurations in the context of hybrid Active Directory environments. Active Directory is the identity system for most organizations: a critical part of your infrastructure, and a prime target for cyberattackers. This week, I’ll discuss the…
Pass the Hash Attack Defense: AD Security 101
- Daniel Petri | Senior Training Manager
Many Active Directory attacks begin with a stolen password. However, a Pass the Hash attack takes a different approach. In this example of credential theft, threat actors instead steal a user’s password hash. The attack is difficult to detect and can lead to privilege escalation and serious damage to your…
NSA Top Ten Cybersecurity Misconfigurations: An Active Directory Perspective (Part 2)
- Daniel Petri | Senior Training Manager
When it comes to cybersecurity—especially the security of critical identity infrastructure—the minimum expectation for every organization should be closing known vulnerabilities and configuration gaps. Welcome to the second of our three-part discussion of how the CISA and NSA top ten cybersecurity misconfigurations list applies to hybrid Active Directory environments and…
