Credential Assessment Mapping Privilege Escalation at Scale Matt - PowerPoint PPT Presentation

Credential Assessment Mapping Privilege Escalation at Scale Matt Weeks @scriptjunkie1

Adversary access (# boxes owned) 10000 1000 100 10 1 Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000

Adversary access (# boxes owned) 10000 Find and fix all the vulnerabilities, block Find known malware. contractor access 1000 The entire AV industry does this. Pentests, vuln Hunt anomalies assessments Fewer do this. Many companies try this. 100 10 1 Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000 Both are important parts of a security program

Adversary access (# boxes owned) 10000 What happened here?! 1000 100 10 1 Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000

Adversary access (# boxes owned) 10000 Bad guys got a DA token; Creds left on a webserver. 1000 100 10 1 Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000

Adversary access (# boxes owned) 10000 Bad guys got a DA token; Creds left on a webserver. 1000 100 10 1 Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000 Malware detection and vulnerable boxes are not the biggest enterprise problem, admin creds lying around all over the domain is.

Scanners Collectors Analysis UI Database

http://extract.ntdsd.it/

Uh oh!

It can be done!