Network component
network_component:domain_controller
Also: domain controller 1, domain controller 2, domain controllers, domain server
A domain controller identified as part of the target environment through public technical postings.
A domain controller identified as part of the target environment through public technical postings.
“That’s my domain controller.”
Authentication and network-mapping infrastructure targeted by the attackers to obtain broad administrative access.
“Their next step is to gain access to a system that communicates to all the other computers in the network, a domain controller.”
“The attackers focused on these domain controllers”
Central Windows-network server whose compromise provided broad access to bank systems.
“their domain controller which is the most important server within the network”
Windows directory-service infrastructure queried for users, groups, and host information.
“dump out the host names of all the domain controllers.”
Central network infrastructure component identified as a key target and foothold during the operation.
“Once you hit the domain controller, you’re good to go”
“taking over domain controllers”
Core network infrastructure responsible for profiles, logins, passwords, permissions, and redundancy in the Maersk environment.
“they didn’t have a backup copy of their domain controllers which are a kind of core backbone of their network.”
“This is the heart of the network, the thing that knows everyone’s profile and logins”
Authentication and authorization infrastructure used by the Olympic IT environment and repeatedly wiped during the attack.
“all of the domain controllers in the Olympics’ data centers in Seoul are being wiped”
“They controlled authentication and authorization for everything”
Central network server exposed to the internet and accessed by users with administrator credentials.
“get into that domain controller which is like the central brain of the network”
“the domain server is not something the users should ever log into”
Central Active Directory system that the attackers reached with full administrative access.
“they got into the domain controller of this network and had full admin access there”
Enterprise infrastructure that Marq managed for MSP customers.
“database servers, and domain controllers.”
Core directory infrastructure in the Academy’s network, including two domain controllers that Adam accessed and targeted for destructive actions.
“there was sort of saved credentials. I think there was domain controller 1, domain controller 2”
“I ran that on I think the domain controller.”
Internal network infrastructure component whose login activity was used as an example of behavior the hospital security team might detect.
“log in to the domain controller and failed a hundred times in a row”
Directory-service server targeted for anonymous enumeration and password spraying in the penetration test.
“maybe on a domain controller”
“authenticate to a domain controller as nobody”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | INVOLVES | Saudi Aramco cyber-attack (2012) | Explicit | 30 |
| incoming | COMPROMISES | Operation Glowing Symphony | Explicit | 50 |
| incoming | AFFECTS | Olympic Destroyer | Explicit | 77 |
| incoming | INVOLVES | police department ransomware incident | Explicit | 96 |
| incoming | COMPROMISES | police department ransomware incident | Explicit | 96 |
| incoming | COMPROMISES | Cloud Hopper | Explicit | 103 |
| incoming | INVOLVES | Academy network attack | Explicit | 113 |
Saudi Aramco cyber-attack (2012) INVOLVES Domain controller
The attackers focused on domain controllers and obtained administrative privileges on them.
Explicit Confidence 98% · Jack Rhysider EP 30 Details
“The attackers focused on these domain controllers”
“the attackers had access to Saudi Aramco’s network and had administrative privileges to the domain controllers”
Operation Glowing Symphony COMPROMISES Domain controller
The operation planned to reach domain controllers as an initial foothold and later took over domain controllers during execution.
Explicit Confidence 96% · Jack Rhysider EP 50 Details
“Once you hit the domain controller, you’re good to go”
“taking over domain controllers”
Olympic Destroyer AFFECTS Domain controller
The malware repeatedly wiped the Olympic domain controllers.
Explicit Confidence 98% · Andy Greenberg EP 77 Details
“they find that as they’re rebuilding domain controllers, for instance, they’re being wiped again by some piece of malware in their system”
police department ransomware incident INVOLVES Domain controller
The attack involved the police department's domain controller, which was accessible and later used to stage malware.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“this police station’s domain controller was accessible from the internet over Remote Desktop”
police department ransomware incident COMPROMISES Domain controller
Unauthorized administrators logged into the domain controller and an attacker uploaded malware to stage another ransomware infection.
Explicit Confidence 98% · Jack Rhysider EP 96 Details
“this user did upload some malware and looks like they were staging it to infect the network with ransomware again”
Cloud Hopper COMPROMISES Domain controller
The attackers gained full administrator access to the customer’s domain controller.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“they got into the domain controller of this network and had full admin access there”
Academy network attack INVOLVES Domain controller
The attack involved running a destructive wipe command against a domain controller.
Explicit Confidence 99% · Adam Georgeson EP 113 Details
“I ran that on I think the domain controller.”