printer friendly version

XM Cyber counters attacks involving Microsoft Active Directory exploits

XM Cyber has announced a new security capability for Microsoft’s Active Directory (AD). XM Cyber is the first to link the use of AD into the entire attack path, bringing multiple attack techniques together and offering a complete and accurate view of an organisation’s cybersecurity risk, across on-premises and cloud environments. With this new capability, enterprises gain end-to-end attack path visualisation for easy understanding and prioritised remediation of all weaknesses before an attack can take place.

A chain of attack vectors (vulnerabilities, misconfigurations, user privileges, human errors, etc.) that enables lateral movement through an organisation’s network is called an attack path. Once an attacker is inside the network, they can move laterally, escalating their privileges and targeting systems to gain access to sensitive data and business-critical resources, and even gain access to the cloud environment by moving from a compromised enterprise AD user to the associated Azure AD user.

AD is widely used by enterprises around the world to connect and manage endpoints inside corporate networks. This makes it an attractive target for hackers seeking to obtain domain admin-level access. An attacker that has compromised an AD user can elevate privileges, conceal malicious activity in the network, execute malicious code, and gain access to the cloud environment, allowing them to compromise assets. The XM Cyber Research team recently reported that 73% of the top attack techniques used to compromise critical assets in 2021 involved mismanaged or stolen credentials; and according to EMA research, at least 50% of organisational attacks are due to AD compromise.

“It is critical to make concentrated efforts to comprehensively secure and monitor AD, proactively look for threats and misconfigurations, and remediate to prevent dangerous actions from taking place,” according to Gartner. ^[1]

The XM Cyber Attack Path Management platform demonstrates how AD abuse comes into play across the entire attack path, bringing together multiple attack techniques to pinpoint the riskiest credentials and permissions across users, endpoints and services managed in AD. This enables organisations to direct resources to remediate the most impactful risks first, using step-by-step guidance. The platform’s comprehensive security posture analysis surfaces AD weaknesses in real time, correlating the likelihood of attacks that can compromise critical assets.

“Existing solutions provide security teams with limited visibility into which users can expose critical assets,” said Boaz Gorodissky, CTO, XM Cyber. “Our unique ability to chain together AD attack techniques gives organisations the edge against attackers, enabling them to reduce their risk before the attack happens. We are committed to providing proactive security so CISOs can focus on maximising resources to protect their most business-critical applications and data.”

Learn more about XM Cyber Active Directory security at https://www.xmcyber.com/use-case/active-directory-security/.

^[1] Gartner, “Emerging Technologies and Trends Impact Radar: Security”, Ruggero Contu, Mark Driver, et al, 12 October 2021.

Share this article:

Further reading: