Active Directory assessments
An Active Directory assessment signs in to one domain with an ordinary domain account and looks for attack paths and risky settings. The tools run on your own sensor, inside your network. The collected directory data never leaves the sensor. OrbitalCyber receives only the findings and a bundle of reports. [!NOTE] Whether Active Directory assessments are included depends on your plan (see Subscription). If they aren't, the scan type shows "not in your plan". What it checks You choose which tools run. By default all four are selected. Tool What it looks at BloodHound + PlumHound (attack paths) Collects the directory over LDAP, then analyses it on the sensor. Checks include: Kerberoastable accounts, AS-REP roastable accounts, unconstrained delegation outside domain controllers, delegation to a domain controller, DCSync rights outside administrators, whether every user (Domain Users, Authenticated Users or Everyone) has a path to Domain Admins, users with an attack path to Domain Admins, privileged accounts whose password never expires, privileged accounts not in Protected Users, privileged accounts inactive for 90 days, computers running unsupported Windows, and computers without LAPS. PlumHound also writes its standard set of reports. Certipy (certificate services) A read-only search of Active Directory Certificate Services (AD CS) for vulnerable certificate templates and certificate authorities (ESC1 to ESC16). If the domain has no AD CS, Certipy is marked Skipped. NetExec (signing, policies) Domain hygiene: password policy (minimum length under 12, no lockout), anonymous (null) SMB sessions on the domain controller, LDAP signing and LDAPS channel binding, MachineAccountQuota (whether any user can add computers), passwords in Group Policy Preferences, and SMB signing on domain computers. GPO audit (GPOverseer) Copies the domain's Group Policy files from SYSVOL and audits the Group Policy settings. Sessions and local admins (optional) Also collect sessions and local admins is off by default. With it off, collection uses LDAP only and is quiet and read-only. When you turn it on, the sensor connects to every computer in the domain to see who is signed in where. This gives richer attack paths, but endpoint security tools often flag it. [!NOTE] The NetExec SMB signing check connects to each enabled computer from the BloodHound collection over SMB, even when sessions are off. If BloodHound isn't selected, only the domain controller is checked. Requirements A sensor inside the network that can reach a domain controller. You can't run this scan type from a cloud scanner. See Sensors. Network access from the sensor to the domain controller: LDAP or LDAPS. The sensor uses LDAPS when the domain controller answers on the LDAPS port. Otherwise it uses LDAP. If a tool fails over LDAPS, it tries LDAP once. The LDAPS certificate isn't validated, because domain controllers usually carry internal or self-signed certificates. DNS, to find the domain controller and resolve names. Queries go to the domain controller over TCP. Kerberos. The tools try Kerberos first. SMB, for NetExec and for copying the Group Policy files from SYSVOL. An Active Directory account saved under Credentials (see below). The account to use A normal (non-admin) domain user is enough. Go to Credentials and select Add credential. For Type, choose Active Directory: domain account. For Scope, enter the domain this account may be used on, for example corp.example.com. Assessments of any other domain refuse it. For Username, enter the account's sign-in name without the domain. This is its sAMAccountName, for example auditor. Don't use an email address. Enter the Password. For Domain, enter the domain's DNS name, for example corp.example.com. Save. The password is encrypted when you save it and is sent only to the sensor that runs the assessment. It's removed from every tool log. Run an assessment Go to Scans and select New scan. For Sensor, choose one of your sensors. For Scan…
OrbitalCyber documentation