Active Directory: results and attack paths

Summary

The Active Directory tab of an internal scan shows where an attacker can reach Domain Admin and which mistakes to fix first. In this lesson you open the scan of the stabilimento-treviglio probe, pick the meccanicaadda.local domain and move from the overview to the findings, then to an attack path and its fix.

Chapters

Key points

• Where to find it: open the internal scan and select the Active Directory tab. If the probe collects several domains, pick one in the switcher. The tab appears whenever the scan has an Active Directory collection, including a failed one.
• Overview: tells you how many findings sit on a live path to Domain Admin and shows the Posture, a score from 1 to 100 with a grade from A to F (A from 90, B from 80, C from 70, D from 60, F below). The score drops with the severity of the findings and the number of objects they affect, and drops further for every finding that sits on a live path. In the example, meccanicaadda.local has a posture of 71 out of 100, grade C.
• Identity: the inventory of users, groups, computers, organizational units and GPOs. The Tier-0 badge marks whoever controls the domain, such as Domain Admins.
• Misconfigurations: the findings catalog, with On path findings first and then by severity (critical, high, medium). In the example, the critical finding is unconstrained delegation on a host that is not a domain controller.
• Attack Paths: each path is a chain of control rights (for example GenericAll, meaning full control) that starts from a non-privileged account and ends at a Tier-0 object. RECON shows up to 12 paths of at most 7 hops. The object that appears on the most paths (at least two) is flagged as the Chokepoint: fixing it breaks the most paths.
• Confidence & effort: confidence is higher the shorter the chain; effort grows with the number of hops and control rights to abuse. The lower the effort, the easier the attack.
• How to break it: the path panel points to the weakest hop to remove: "Revoke that right (or harden the object it targets) and the chain no longer reaches Tier-0."
• What to fix first: in Overview, the Fix first — on a live path table puts the findings that sit on a path at the top. Open a finding to read its Remediation: for Kerberoasting, for example, move service principal names to group managed service accounts (gMSA) or enforce long random passwords on service accounts.
• Comparison: a domain with no path to Tier-0 shows "No attack path to Tier-0 was found in the collected graph." In the example, addaservizi.local has a posture of 93, grade A.

Transcript

The full transcript of the video, in Italian, is in the player's Transcript tab.

Related articles