Threat Research

Unconstrained Delegation Explained

Unconstrained Delegation Explained

  • Huy Kha | Senior Identity & Security Architect

Cybersecurity agencies from the Five Eyes alliance, including CISA and the NSA, have urged organizations to strengthen security around Microsoft Active Directory (AD), a prime target for cyberattackers. The alliance’s recent report highlights more than a dozen tactics that threat actors use to exploit AD. Among these common techniques is…

AS-REP Roasting Explained

AS-REP Roasting Explained

  • Huy Kha | Senior Identity & Security Architect

Authentication Server Response (AS-REP) Roasting enables attackers to request encrypted authentication responses for accounts in Active Directory that have Kerberos pre-authentication disabled. AS-REP Roasting is one of the Active Directory threats that cybersecurity agencies in the Five Eyes alliance warn about in the recent report, Detecting and Mitigating Active Directory…

LDAPNightmare Explained

LDAPNightmare Explained

  • Eric Woodruff

LDAPNightmare, recently published by SafeBreach Labs, is a proof-of-concept exploit of a known Windows Lightweight Directory Access Protocol (LDAP) denial-of-service vulnerability (CVE-2024-49113). What is LDAPNightmare, how dangerous is this exploit, and how can you detect and defend against it? What is LDAPNightmare? The December 2024 Windows update - published by…

A New App Consent Attack: Hidden Consent Grant

A New App Consent Attack: Hidden Consent Grant

  • Adi Malyanker | Security Researcher

Key findings An Application Consent attack, also known as an Illicit Consent Grant attack, is a type of phishing attack in which a malicious actor gains access to an application and then exploits permissions that have been granted to that app. Semperis researcher Adi Malyanker has discovered that under certain…

UnOAuthorized: Privilege Elevation Through Microsoft Applications

UnOAuthorized: Privilege Elevation Through Microsoft Applications

  • Eric Woodruff

This article details a series of Semperis security research team discoveries that resulted in the ability to perform actions in Entra ID beyond expected authorization controls, based on analysis of the OAuth 2.0 scope (permissions). Our most concerning discovery involved the ability to add and remove users from privileged roles,…

New Ransomware Statistics Reveal Increased Need for Active Directory Security and Resilience

New Ransomware Statistics Reveal Increased Need for Active Directory Security and Resilience

  • Mickey Bresman

By now, we’re all familiar with the need for an “assume breach” mindset where ransomware and other cyber threats are concerned. To better understand the necessity and challenges of this approach, we partnered with international market research firm Censuswide to ask organizations about their experience with ransomware attacks. What we…

How to Defend Against SPN Scanning in Active Directory

How to Defend Against SPN Scanning in Active Directory

  • Daniel Petri | Senior Training Manager

Service Principal Name (SPN) scanning is a reconnaissance technique that attackers use in Active Directory environments. This method enables attackers to discover valuable services and associated accounts, which can be potential targets for further attacks such as Kerberoasting. Related reading: Protect Active Directory against Kerberoasting What is SPN scanning? Understanding…

Identity Attack Watch: AD Security News, June 2024

Identity Attack Watch: AD Security News, June 2024

  • Semperis Research Team

As cyberattacks targeting Active Directory continue to rise, AD security, identity, and IT teams face mounting pressure to monitor the evolving AD-focused threat landscape. To assist IT professionals in comprehending and preventing attacks that involve AD, the Semperis Research Team publishes a monthly roundup of recent cyberattacks and provides additional…