Identity Attack Catalog
Categories
- Active Directory Backup & Recovery (62)
- Active Directory Security (213)
- AD Security 101 (17)
- Community Tools (19)
- Directory Modernization (9)
- From the Front Lines (69)
- Hybrid Identity Protection (68)
- Identity Attack Catalog (27)
- Identity Threat Detection & Response (143)
- Our Mission: Be a Force for Good (14)
- Purple Knight (5)
- Semperis University (1)
- The CISO's Perspective (16)
- Threat Research (68)
LDAPNightmare Explained
- Eric Woodruff
- Jan 13, 2025
LDAPNightmare, recently published by SafeBreach Labs, is a proof-of-concept exploit of a known Windows Lightweight Directory Access Protocol (LDAP) denial-of-service vulnerability (CVE-2024-49113). What is LDAPNightmare, how dangerous is this exploit, and how can you detect and defend against it? What is LDAPNightmare? The December 2024 Windows update - published by…
Zerologon Exploit Explained
- Huy Kha | Senior Identity & Security Architect
- Nov 15, 2024
In a Zerologon exploit, an attacker with access to a network takes advantage of a critical flaw in the Netlogon Remote Protocol (MS-NRPC) to impersonate any computer, including a domain controller (DC). This flaw is known as Zerologon—a vulnerability that can give attackers full control over a domain. What is…
Kerberoasting Explained
- Huy Kha | Senior Identity & Security Architect
- Oct 11, 2024
A recent report from the cybersecurity agencies in the Five Eyes alliance, including CISA and the NSA, urges organizations to strengthen the security of their Microsoft Active Directory (AD) deployments—a prime target for cyber attackers. The report describes dozens of attack techniques that attackers use to breach AD, including Kerberoasting.…
DCSync Attack Explained
- Huy Kha | Senior Identity & Security Architect
- Oct 09, 2024
Cybersecurity agencies from the Five Eyes alliance, including CISA and the NSA, are urging organizations to strengthen security around Microsoft Active Directory (AD), a prime target for cyberattackers. The alliance's recent report highlights more than a dozen tactics that threat actors use to exploit AD. Among these common techniques is…
Password Spraying Detection in Active Directory
- Huy Kha | Senior Identity & Security Architect
Password spraying detection is a vital ability for all organizations. In a password spraying attack, the attacker attempts to gain unauthorized access by trying a few common or weak passwords across many accounts rather than targeting a single account with many passwords. The idea is to test several passwords, hoping…
A New App Consent Attack: Hidden Consent Grant
- Adi Malyanker | Security Researcher
Key findings An Application Consent attack, also known as an Illicit Consent Grant attack, is a type of phishing attack in which a malicious actor gains access to an application and then exploits permissions that have been granted to that app. Semperis researcher Adi Malyanker has discovered that under certain…
UnOAuthorized: Privilege Elevation Through Microsoft Applications
- Eric Woodruff
This article details a series of Semperis security research team discoveries that resulted in the ability to perform actions in Entra ID beyond expected authorization controls, based on analysis of the OAuth 2.0 scope (permissions). Our most concerning discovery involved the ability to add and remove users from privileged roles,…
How to Defend Against SPN Scanning in Active Directory
- Daniel Petri | Senior Training Manager
Service Principal Name (SPN) scanning is a reconnaissance technique that attackers use in Active Directory environments. This method enables attackers to discover valuable services and associated accounts, which can be potential targets for further attacks such as Kerberoasting. Related reading: Protect Active Directory against Kerberoasting What is SPN scanning? Understanding…
