21,734 reputation
6 3

Greg Askew

Good write-up of the various methods used by your adversaries to compromise Active Directory security:

http://dfir-blog.com/2015/12/13/protecting-windows-networks-kerberos-attacks/


If you are using Windows 7/2008 R2, KB2871997 should be installed to ensure that Windows credentials are removed upon logoff. Without this hotfix, administrator credentials remain in memory until the computer is restarted, which significantly elevates the risk of pass-the-hash attacks.

Additionally, WDigest credentials are enabled by default in Windows 7/2008 R2, which results in plain text credentials being stored in memory. (WDigest credentials are disabled by default in Windows 8.1\2012 R2 and later). This should be disabled using the registry fix in the article:

http://blogs.technet.com/b/srd/archive/2014/06/05/an-overview-of-kb2871997.aspx


Good overview of the new Isolated User Mode feature of Windows 10/Server 2016 and how that can protect against pass-the-hash attacks:

https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode


AD Security definitive reference:

https://adsecurity.org/?page_id=1821


Enterprise Administrator at one of the largest Microsoft Active Directory installations in the world. In addition to most things Microsoft and Windows, I also maintain IIS/SQL Servers and write code for managing the infrastructure of the organization.

Top Tags (1)

Score 0
Posts 1
Posts % 100

Top Posts (1) All Questions Answers | Votes Newest

Badges (9)

Gold
Silver 6

Rarest

Bronze 3

Rarest