Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe
  • Twitter
  • Facebook
  • LinkedIn

New In Nessus: Find and Fix These 10 Active Directory Misconfigurations

New In Nessus: Find and Fix These 10 Active Directory Misconfigurations

Let's face it: Active Directory is a feeding frenzy for hackers. Here's how our updated Nessus scan engine can help you disrupt attack paths.

Active Directory (AD) has been the leading identity and access management solution for organizations over the past 20 years. It's an impressive lifespan for a product that hasn't fundamentally evolved since its first release.

Such stability is commendable and has allowed Active Directory users — a whopping 90% of the Global Fortune 1000 — to implement longlasting authentication and authorization strategies rooted in solid ground. 

On the downside, this stability gave plenty of time for threat actors to skill-up and design equally solid AD-centric attacks from external and internal positions alike. The situation is compounded by the fact that most organizations designed their AD implementations years ago and rarely revisit them with an eye toward present-day security threats.. 

Today, let's face it: AD is a feeding frenzy for hackers

Behind every headline-grabbing breach or critical infrastructure-crippling ransomware attack is a misconfigured AD deployment. Ok, maybe not all of them, but the vast majority of attacks — whether sophisticated or by-the-book — require flaws in AD which allow an attacker to move laterally and gain those all-important admin privileges.

If cybercrime is an existential threat to our society, then all organizations need to be informed immediately of the state of (in)security of their AD. Only then will they be able to truly align their security tactics with the reality of their threat landscape.

This is why Tenable recently acquired Alsid and released Tenable.ad. We understand how AD plays a critical role in managing single sign-on processes and the level of access users are granted once authenticated. Tenable.ad provides holistic AD security enabling you to find and fix existing weaknesses and detect ongoing attacks in real time without the need to deploy agents or use privileged accounts. And when combined with our industry-leading Risk-based Vulnerability Management solution, Tenable.ad can disrupt the attack path, ensuring attackers struggle to find a foothold and have no next step if they do.

Today, we're going a step further in our AD security journey. We have incorporated 10 foundational AD checks directly in Nessus. Now, users of Nessus Essentials, Nessus Professional, Tenable.sc, Tenable.io and Tenable.ep can detect commonly exploited weaknesses to help protect credentials and prevent privilege escalation. These plugin checks generally fall into two categories:

  1. Password and credential protection to help prevent attackers from implementing brute-force attacks on credentials and impersonating other users or accounts.
  2. Privilege escalation and lateral movement to limit the ability for attackers to obtain excessive rights or privileges to move across domains.

The full list of AD plugins are as follows:

Password and Credential Protection

Plugin name Description
Kerberoasting A Domain admin or Enterprise admin account is vulnerable to the Kerberoasting attack.
  • Kerberoasting is a password-cracking attack that eventually allows threat actors to impersonate legitimate users. Attackers typically leverage this method against admin accounts to achieve lateral movement and domain domination.
  • This check ensures no admin account is vulnerable to such attacks.
Weak Kerberos encryption The Kerberos encryption is too weak on one user account leading to potential credential theft.
  • Kerberos still accommodates older encryption protocols that are vulnerable to brute force attacks. Attackers systematically look for such deprecated protocols so they uncover users' credentials.
  • This check ensures no vulnerable encryption protocols are leveraged for Kerberos authentication.
Kerberos pre-authentication validation The Kerberos pre-authentication is disabled on one user account leading to potential credential theft.
  • Attackers routinely target accounts with disabled pre-authentication with AS-REP roasting attacks to guess their passwords.
  • This check uncovers accounts which do not implement pre-authentication handshakes and are susceptible to password theft.
Non-expiring account password A user account may never renew its password.
  • AD accounts can be configured to escape global password renewal policies, thus breaching the most elementary hygiene best practice and allowing attackers to execute password-guessing scenarios at will.
  • This check identifies users and administrators matching this non-expiring password attribute.
Unconstrained delegation Unconstrained delegation is allowed on a computer account allowing potential credential theft.
  • When a user authenticates on a server that is trusted for delegation, a copy of the user's credentials is sent to the server by the domain controller. Attackers routinely hunt for weak servers with trusted delegation so they can compromise them and eventually get sent all the credentials they need to achieve domain dominance.
  • This check verifies this trusted delegation property is only allowed on trusted servers such as domain controllers.
Null sessions The Anonymous or Everyone group is part of the "Pre-Windows 2000 Compatible Access " allowing null session attacks.
  • The Pre-Windows 2000 Compatible Access group is a backward-compatibility mechanism with read permissions on most of the domain data. By default, this group allows unauthenticated users, including attackers, to perform target discovery and to carry out brute-force attacks.
  • This check verifies the Pre-Windows 2000 Compatible Access usages, in accordance with security best practices.

Privilege Escalation and Lateral Movement Prevention

Plugin name Description
Kerberos KRBTGT The Kerberos master key is too old and could be used as a backdoor.
  • Every AD domain harbors a special, all-powerful account called KRBTGT. This account is literally the key to everything in the domain and is therefore an invaluable target for attackers.
  • This check ensures this master key is set to be renewed at least once every two years, as best practices recommend.
Dangerous trust relationship No security mechanism has been activated on a trust relationship allowing lateral movement across AD domains.
  • Trust relationships are integral to the way AD operates, and are meant to allow legitimate lateral movement. Threat actors typically try — and succeed — to exploit this mechanism to their advantage to achieve lateral movement.
  • This check verifies the feasibility of two common attack scenarios aimed at exploiting legitimate trust relationships: SID History Injection and Printer Bug Exploit.
Primary Group ID integrity A potential backdoor using the Group ID has been found on a user account.
  • Primary Group ID is an AD feature that was created to support legacy UNIX applications which didn't support more traditional group membership settings. Primary Group ID is often overlooked by admins and tools and can allow attackers to escalate their rights without being formally members of a privileged group.
  • This check uncovers Primary Group ID mechanism usages, in accordance with security best practices.
Blank passwords A user account may use a blank password to authenticate on the domain.
  • Accounts without a password are obvious targets for attackers seeking to elevate their privileges.
  • This check verifies no such account exists.

In addition to the new AD plugins, we have also created a new scan template (Active Directory Starter Scan) and a preconfigured dashboard (Getting Started with Active Directory Security) to help you easily discover and analyze these basic AD weaknesses. The new AD plugins and scan template are available in Nessus Essentials, Nessus Professional, Tenable.sc, Tenable.io and Tenable.ep. The new preconfigured AD security dashboard is available today in Tenable.sc and will be available in Tenable.io and Tenable.ep on August 5.

How to find and fix 10 Active Directory Misconfigurations using Nessus_1

Tenable has created a new scan template to support AD security.

How to find and fix 10 Active Directory Misconfigurations using Nessus_2

Example of the new pre-configured Tenable dashboard for getting started with AD security.

These new AD security capabilities in the Nessus scan engine are a great first step toward disrupting attack paths before you are ready to embark on a more comprehensive AD security program. 

While we're on the topic of AD security, we're excited to announce the release of Tenable.ad 3.1 with a number of enhancements to help you detect critical Indicators of Attack (IoA) faster. New filters and visualizations help threat hunters accelerate their efforts to isolate malicious behavior and turn attacks into attempts.

Learn more

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

Try for Free Buy Now
Tenable.io FREE FOR 30 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now
Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year. Full details here.

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 30 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 30 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try for Free Contact Sales

Try Tenable Lumin

FREE FOR 30 DAYS

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.