Software
software:active_directory
Also: AD, Windows Active Directory, active directory server
Directory service used by the penetration-testing team to look up internal personnel through the global address list.
Directory service used by the penetration-testing team to look up internal personnel through the global address list.
“they had full control of their active directory server”
Windows directory and authentication mechanism containing users, groups, hosts, policies, and related domain information.
“Active Directory is the mechanism that Windows computers authenticate to each other.”
Directory service infrastructure whose Las Vegas server was wiped, unintentionally severing connections to Sands properties in China and Singapore.
“the wiper virus hit the active directory server in Las Vegas and completely wiped it out”
Windows directory system whose Group Policy functionality was used to surveil workstations.
“You can configure Windows Active Directory to use GPO”
Directory and enterprise identity environment whose administrator account was compromised and whose forest management was later analyzed.
“one of our three enterprise admins for AD’s account was compromised”
“an entire analysis of the Active Directory forest management”
Directory service whose administrator credentials were exposed and whose domain controller was accessed.
“including several Active Directory domain administrators”
Directory and identity-management system used in the Academy’s environment and accessible through its administrative setup.
“He learned about domain controllers, Active Directory, Office 365”
“look at and configure the Active Directory settings”
Directory service environment assessed during penetration testing, including enumeration and privilege escalation.
“we found some misconfigurations in Active Directory”
“the entire AD database of hashes”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | Group Policy | Explicit | 42 |
| incoming | USES | Tinker Secor | Explicit | 36 |
| incoming | INVOLVES | World Bank network intrusion | Explicit | 91 |
| incoming | USES | The Academy | Explicit | 113 |
Tinker Secor USES Active Directory
Tinker queried Active Directory and later extracted users, groups, host names, and other domain information.
Explicit Confidence 99% · Tinker Secor EP 36 Details
“I logged into SYSVOL on the main controller, pulled all of Active Directory.”
Active Directory USES Group Policy
The episode explains that Active Directory can use Group Policy to perform surveillance on workstations.
Explicit Confidence 98% · Viss EP 42 Details
“You can configure Windows Active Directory to use GPO”
World Bank network intrusion INVOLVES Active Directory
An enterprise administrator account for Active Directory was compromised during the intrusion.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“one of our three enterprise admins for AD’s account was compromised”
The Academy USES Active Directory
The Academy used Active Directory as part of its network administration.
Explicit Confidence 96% · Jack Rhysider EP 113 Details
“look at and configure the Active Directory settings”