Credential Assessment Mapping Privilege Escalation at Scale Matt - - PowerPoint PPT Presentation

▶
credential assessment
SMART_READER_LITE
LIVE PREVIEW

Credential Assessment Mapping Privilege Escalation at Scale Matt - - PowerPoint PPT Presentation

Feb 13, 2023 264 likes •737 views

Credential Assessment Mapping Privilege Escalation at Scale Matt Weeks @scriptjunkie1 Adversary access (# boxes owned) 10000 1000 100 10 1 Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Adversary access (#

slide-1
SLIDE 1

Credential Assessment

Mapping Privilege Escalation at Scale Matt Weeks @scriptjunkie1

slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4
slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9
slide-10
SLIDE 10

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000 1 10 100 1000 10000

Adversary access (# boxes owned)

slide-11
SLIDE 11

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000 1 10 100 1000 10000

Adversary access (# boxes owned)

Find and fix all the vulnerabilities, block contractor access Pentests, vuln assessments Many companies try this. Find known malware. The entire AV industry does this. Hunt anomalies Fewer do this. Both are important parts of a security program

slide-12
SLIDE 12

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000 1 10 100 1000 10000

Adversary access (# boxes owned)

What happened here?!

slide-13
SLIDE 13

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000 1 10 100 1000 10000

Adversary access (# boxes owned)

Bad guys got a DA token; Creds left on a webserver.

slide-14
SLIDE 14

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Adversary access (# boxes owned) 1 1 2 2 2 10000 10000 10000 10000 10000 1 10 100 1000 10000

Adversary access (# boxes owned)

Malware detection and vulnerable boxes are not the biggest enterprise problem, admin creds lying around all over the domain is.

Bad guys got a DA token; Creds left on a webserver.

slide-15
SLIDE 15
slide-16
SLIDE 16
slide-17
SLIDE 17
slide-18
SLIDE 18
slide-19
SLIDE 19
slide-20
SLIDE 20

Scanners Collectors Database Analysis UI

slide-21
SLIDE 21
slide-22
SLIDE 22

http://extract.ntdsd.it/

slide-23
SLIDE 23
slide-24
SLIDE 24

Uh oh!

slide-25
SLIDE 25
slide-26
SLIDE 26
slide-27
SLIDE 27
slide-28
SLIDE 28
slide-29
SLIDE 29
slide-30
SLIDE 30
slide-31
SLIDE 31
slide-32
SLIDE 32
slide-33
SLIDE 33
slide-34
SLIDE 34
slide-35
SLIDE 35
slide-36
SLIDE 36
slide-37
SLIDE 37
slide-38
SLIDE 38

It can be done!

slide-39
SLIDE 39
slide-40
SLIDE 40
slide-41
SLIDE 41
slide-42
SLIDE 42
slide-43
SLIDE 43
slide-44
SLIDE 44
slide-45
SLIDE 45