Learn about Active Directory Protection in this short one-minute video

OVERVIEW

Attacks on Active Directory (AD) used to be limited to well-financed and state-backed attackers. With automated attack tools, basic “script kiddies” can now quickly and successfully exploit Active Directory systems.

Attackers perform reconnaissance to identify regular IT activities and security measures once inside the target network and will scan the entire IT environment to gain an accurate picture of resources, privileged accounts, and services. Active Directory, and Domain controllers are prime reconnaissance targets to hunt for additional privileged credentials and privileged access.

Once attackers compromise Active Directory, they gain a digital map of the network and can reuse stolen credentials to move laterally inside. Losing domain administrator control over the Active Directory environment is essentially game over for the defender.

Traditional security tools such as SIEMs attempting to monitor logs have not been efficient in detecting AD attack activity. Maintaining Active Directory privileges and policies doesn’t stop someone from enumerating privileged accounts and critical assets. Overprovisioning can also leave AD data exposed to attack.

Attivo Networks provides several endpoint-based solutions that can work independently or as part of a combined solution to address these concerns.

Free Active Directory Security Assessment for Unprecedented Visibility to AD Vulnerabilities

Awards for Active Directory Protection

SC 2020 Awards
Info Security Products Guide 2020 Gold
Astors award platinum 2019

THE STATE OF ACTIVE DIRECTORY

Don’t leave the door open for attackers to secure the “keys to the kingdom”.

Mitigate Cyber Risk

Active Directory Mismanagement Exposes 90% of Businesses to Breaches

High-fidelity alert

95 million AD accounts are the target of cyberattacks every day

Penetration Testers Breach Active Directory Nearly 100% of the Time

Penetration Testers Breach Active Directory Nearly 100% of the Time Indicating That Attackers Can Do the Same

80% of security breaches involve privileged access abuse

PRIVILEGED CREDENTIAL AND ACCESS PROTECTION

Uncover credential and Active Directory access weaknesses before an attacker can leverage them to exploit AD or advance their attack. Detect & respond to attacks in real time.

Proactive Prevention
ATTACK PREVENTION

Active Directory assessment for continuous visibility into AD hygiene related to identities and privileged account risk related

REAL TIME DETECTION

Detect privilege escalation and granularly restrict access to AD information without impacting business operations

High-fidelity alert
ACTIONABLE ALERTING

High-fidelity alerts to key exposures at the Domain, computer, and -user level

CONDITIONAL ACCESS

Manage Identity entitlements and least privileges across on-premises and multi-cloud environments

Active Directory Protection Coverage

Keep businesses safe by preventing the misuse of privileged credentials and accounts with continuous Active Directory assessment and attack path visibility. Expose and remediate at risk credentials and paths that provide access to an organization’s most valuable assets.

CREDENTIALS
SHADOW ADMINS
STALE ACCOUNTS
SHARED CREDENTIALS
IDENTITY ATTACK PATHS

Benefits

The Attivo EDN Suite is tackling endpoint security challenges head-on by making every endpoint a decoy designed to disrupt an attacker’s ability to break out and further infiltrate the network.

Early Detection of known and unknown attacks

Ability to disrupt attacks during observation vs. waiting for an active attack

Scalability across a wide-variety of endpoints

Machine-learning for automated deployment

Capabilities to collect adversary intelligence and forensic data

Serve as a powerful protection force-multiplier for businesses using Endpoint Protection (EPP) and Endpoint Detection and Response (EDR) solutions by closing detection gaps and facilitating automated incident response

Improved detection proficiency during Red Team testing and security assessments

Attivo Active Directory Protection Solutions

Attivo Active Directory Protection Solutions

Active Directory-Specific MITRE ATT&CK Techniques

Attivo Networks Active Directory protection provides comprehensive security for MITRE ATT&CK Techniques

  • T1003: OS CREDENTIAL DUMPING (DCSYNQ)

    • Domain groups
    • Cloud groups
    • Local groups


  • T1069: PERMISSION GROUP DISCOVERY


  • T1078: VALID ACCOUNTS


  • T1087: ACCOUNT DISCOVERY

    • Local Account
    • Domain Account
    • Email Account
    • Cloud Account


  • T1135: NETWORK SHARE DISCOVERY


  • T1207: ROGUE DOMAIN CONTROLLER (DCSHADOW)


  • T1482: DOMAIN TRUST DISCOVERY


  • T1550: USE ALTERNATE AUTHETICATION MATERIAL

    • Golden ticket attack
    • Silver ticket attack


  • T1557: STEAL OR FORGE KERBEROS TICKETS: (KERBEROASTING)

ACTIVE DIRECTORY-SPECIFIC MITRE TECHNIQUES

Popular ransomware attacks that leverage Active Directory

Active Directory Protection Solutions

How Attivo Derails Active Directory-based Ransomware Attacks

How Attivo Derails Active Directory-based Ransomware Attacks

ATTIVO NETWORKS ACTIVE DIRECTORY SOLUTION CAPABILITIES

Attivo provides prevention, detection, and visibility solutions for protecting an organization’s Active Directory environment on-premises and in the cloud.

The ADAssessor solution identifies AD weaknesses and exposures to detect advanced attacks in real-time. The ADSecure solution prevents exploitation of Active Directory by efficiently concealing real Active Directory objects, raising alerts on unauthorized activities, and returning misinformation for derailing the attack. These protections are all achieved without altering the production Active Directory environment.

Additionally, for organizations looking to add visibility to exposed local administrator credentials on the endpoint, misconfigured ACLs, or attack paths by application and severity they can purchase the EDN Suite, which provides ADSecure and ThreatPath functionality.

ADAssessor Vulnerability Assessment

  • Identify exposures and misconfigurations
  • See bulk changes and dangerous delegations
  • Reduce AD attack surface
  • Detect advanced attacks in real-time

ADSecure Live Attack Detection

  • Alert on unauthorized queries to AD
  • Hide and deny access to AD Objects
  • Gather adversary TTP’s and IOCs
  • Automated response

EDN: ThreatPath
Endpoint Vulnerability Assessment

  • Exposed local administrator credentials
  • Identify Shadow Admins
  • Find misconfigured ACLs
  • Attack paths by application and severity

“The ADSecure solution is critical for any company that wants to defend and monitor Active Directory solutions. Don’t hesitate to include it as part of your implementation.”

Gartner Peer Insights