Microsoft Active Directory

Reported Context (58)

on every Active Directory user object. Include info Akira Intrusion Used ClickFix to Gain Domain Admin and Encrypt 485,224 Files
and then engaged in a variety of post-compromise activities, from accessing the organization's Active Directory to deleting exploitation evidence from Ivanti debug logs. Volexity researchers said because the Attackers Exploit Ivanti Connect Secure Zero-Day Before Fix Reached All Supported Versions
Volexity identified a range of post-exploitation actions undertaken by the threat actor that targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and Ivanti Connect Secure Zero-Days Chained for Unauthenticated Root Access
Roughly two hours later, the attacker used RDP to access the domain controller and began enumerating Active Directory. Attackers Exploit MFA Gaps in VPN, RDP and Windows Access
Most practitioners are familiar with Active Directory (AD) resilience, given that adversaries frequently target AD to bring down operations. Many practitioners remember the Maersk NotPetya destructive malware incident Why Identity Resilience Is Essential to Cyber Resilience

CVE (24)

Malware (66)

People (56)

Threat Actors (105)

MITRE ATT&CK (180)

Vendors (45)

Products (146)

Tools (159)

Industries (76)

Countries (64)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.