A happy new year to everybody!
At Troopers18 there will be a new special track on Microsoft Active Directory and its security aspects, similar to the SAP security track which we established some years ago. The AD security track will feature, amongst others, the following talks.
Sean Metcalf: Active Directory Security. The Journey
Abstract: This talk is a journey into the challenges most organizations encounter while trying to secure their ‘castle’. The attacker has to be right only once, right? Not exactly. We will walk through effective security strategies that will stymie and frustrate attackers and better protect the Active Directory environment.
Attackers have set their sights squarely on Active Directory when targeting a company, though this typically isn’t the primary objective. The motivation and end goals range from stealing data to impacting corporate operations. In this regard, gaining control of Active Directory is a means to an end; compromising Active Directory is an easy way to gain access to all critical corporate resources. Effectively protecting Active Directory has become critical in limiting the impact of a breach.
This talk takes the audience on a journey covering the various security milestones and challenges with Active Directory. A variety of (fictionalized) companies and their AD security posture are highlighted along with the challenges they encounter with securing their systems. Key elements involve how enterprise “AD aware” applications can weaken Active Directory security and how leveraging cloud services complicate securing infrastructure. Also explored is what an attacker can do in an environment without having Domain Admin rights. The final section discusses the commonly heard excuses for not implementing security controls to protect Active Directory and the ways to counter these arguments.
Join the author of ADSecurity.org as he covers the critical issues affecting organizations today, as well as the biggest challenges; current attack techniques; and the most effective defensive techniques to prevent and mitigate compromise (including limitations to these approaches).
Bio: Sean Metcalf is founder and principal consultant at Trimarc Security, LLC (www.TrimarcSecurity.com), which focuses on mitigating, detecting, and when possible, preventing modern attack techniques. He is one of about 100 people in the world who holds the Microsoft Certified Master Directory Services (MCM) certification, is a former Microsoft MVP, and has presented on Active Directory attack and defense at Black Hat, BSides, DEF CON, DerbyCon, Shakacon and Sp4rkCon security conferences.
Sean has provided Active Directory and security expertise to government, corporate, financial, and educational entities since Active Directory was released. He currently provides security consulting services to customers and regularly posts interesting Active Directory security information on his blog, ADSecurity.org. Follow him on Twitter.
===
Vineet Bhatia: Defending Microsoft Environments at Scale
Abstract: Defending a Microsoft Environment at Scale looks at the innovations made in Windows 10 and the capabilities of a Microsoft stack to launch a capable defense against most vulnerability classes. The talk is based on a direct mapping of the MITRE ATTACK framework to the defense classes within the Microsoft offering.
This talk focuses on leveraging capabilities of a Microsoft stack to launch a capable defense against most vulnerability classes. It starts out by describing the MITRE ATTACK framework and how it has been used by us internally to build a defense model. We then expand to talk about specific capabilities of the Windows subsystem to detect and respond to the following: Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Execution, Collection, Exfiltration and Command and Control (C2).
As we continue, we describe a working defense model that extrapolates the telemetry from these indicators across Microsoft Windows to an enterprise view that reduces noise and improves signal. In order to do this, we explain how WEF works, a sample Sysmon deployment guide and how to collect rich event meta-data from all Windows Event Log sources to build correlation. This goes beyond traditional SIEM implementations and talks about specific use cases that address the MITRE ATTACK framework.
During the second half of the talk, we explain how to scale this to geographically dispersed machines and build correlation and response when physical / remote access might not be available. A high-level overview of the native Windows Defender engine is provided and how the expanded Windows Defender ATP product allows us to perform frequency analysis, look at process trees and generally identify malicious behavior on the endpoint.
In closing, we round up some of the capabilities of the Azure and Office365 cloud to talk about credential sync and cloud app security engines. This explains the protections offered to the end user and their access to any data source. The expectation is to address normal vs. abnormal user behavior and proactively identify users with weak credentials.
Bio: Vineet Bhatia ‘s work focuses on digital forensics, threat hunting and aviation cybersecurity.
===
Will Schroeder & Andy Robbins: An ACE Up The Sleeve. Designing Security Descriptor Based Backdoors
Abstract: Active Directory (AD) and host-based security descriptors are an untapped offensive landscape, often overlooked by attackers and defenders alike. The control relationships between AD and host objects align perfectly with the “attackers think in graphs” philosophy and expose an entire class of previously unseen control edges, dramatically expanding the number of paths to complete domain compromise.
While security descriptor misconfigurations can provide numerous paths that facilitate elevation of domain rights, they also present a unique chance to covertly deploy persistence in an Active Directory environment. It’s often difficult to determine whether a specific security descriptor misconfiguration was set intentionally or implemented by accident, and modifications to specific host security descriptors can have far-reaching and unintended consequences in the domain as a whole. This makes security descriptor-based backdoors an excellent persistence opportunity: minimal forensic footprint, and maximum plausible deniability.
This talk will cover Active Directory and host security descriptors in depth, including our “misconfiguration taxonomy” and enumeration/analysis with BloodHound’s ever-expanding released feature set. We will cover how specific host host-based security descriptor modifications can affect the security of the system as a whole, filling in the gaps from the pure Active Directory approach. We will then cover methods to design chains of these backdoors, producing novel Active Directory persistence paths that evade most current detections.
Bios: Will Schroeder (@harmj0y) is a offensive engineer and red teamer for SpecterOps. He is a co-founder of Empire/Empyre, BloodHound, and the Veil-Framework, developed PowerView and PowerUp, is an active developer on the PowerSploit project, and is a Microsoft PowerShell MVP. He has presented at a number of conferences on a variety of topics, including DEF CON, Black Hat, ShmooCon, DerbyCon, Troopers, BlueHat Israel, and various Security BSides conferences.
Andy Robbins (@_wald0) is the Adversary Resilience Lead at SpecterOps, an active red teamer, and co-author of the BloodHound project, a tool designed to reveal the hidden and unintended permission relationships in Active Directory domains. He has presented at DEF CON, Black Hat, BSides Las Vegas, DerbyCon, ekoparty, and actively researches Active Directory security.
===
Hao Wang: Attack and defend Microsoft Enhanced Security Administrative Environment
Abstract: Microsoft Enhanced Security Administrative Environment (ESAE) known as “Red Forest” has become a very popular architecture solution to enhance the security of Active Directory. Can ESAE be used to completely prevent cyber attackers from compromising Active Directory? In this talk, we will demonstrate the commonly overlooked techniques that can be used to obtain domain dominance within ESAE.
With the hardened admin environment and credentials partitioning solution built into Microsoft Enhanced Security Administrative Environment (ESAE), it can be extremely hard to compromise critical components of Active Directory such as domain controllers even after obtaining complete control of servers and
workstations. However, we found that there are multiple security controls that Enterprise always overlooks when implementing ESAE, which potentially allow
cyber attackers to compromise Active Directory within a short period of time.
During this presentation, we will focus on the commonly overlooked tools and techniques that can be used to compromise ESAE. First, we will demonstrate the approach used to identify and compromise shadow admin accounts with special delegated permissions that are typically overlooked since they are not members of a privileged Active Directory group. Our research disclosed that some domain accounts designed to run Microsoft Exchange and SharePoint servers are always configured with special delegated permissions which can be potentially used to replicate password hashes directly from domain controller, add any domain accounts into Domain Admin or Enterprise Admin group, and reset the passwords for privileged domain accounts within ESAE. Second, we will demonstrate how to compromise Enterprise virtualization platform such as VMware vCenter, which is used to host critical components of ESAE such as domain controllers. The secrets including all domain users’ password hashes can be potentially extracted from the virtualized image of domain controller via a hot clone approach we discovered.
Third, we will talk about how to attack Enterprise security solutions, such as System Center Configuration Manager (SCCM), Multi-Factor Authentication (MFA), and other endpoint monitoring technologies, which are implemented across ESAE.
A number of Enterprise Security solutions are always granted to have privileged access to the endpoints with remote command execution capability but not well protected. We will introduce a few creative approaches to compromise ESAE and demonstrate how to bypass Multi-Factor Authentication (MFA) implemented within ESAE. We will conclude the presentation with some recommended strategic countermeasures. We hope that this talk helps to educate and arm Enterprise defenders with the knowledge to enhance the security controls of ESAE
Bio: Hao Wang is a manager in Ernst & Young’s Advanced Security Center. Hao has more than six years of Attack & Penetration testing and Cyber Investigation experience. Hao is currently responsible for leading Attack & Penetration assessments for Fortune 500 companies. Hao has utilized his experience as a lead tester on a wide array of red team and purple team assessments. Hao serves as a core technical team member for ASC, regularly contributing new hacking techniques to the team. His areas of research include advanced Active Directory attack against Microsoft ESAE, exploit development for both point of sale systems and gaming systems, and cyber threat hunting.
===
Stay tuned for further announcements…
cheers, Enno