I've seen a lot of Active Directory environments in the last 5+ years. These are some of the most dangerous issues I recommend reviewing and addressing in your environment. Treat it like a check list. If you have 0 of these, you're doing a great job.

IT Admin Monday Checklist: 1. Run Locksmith/Locksmith2 2. If any ESC1 are identified, and the templates are enabled, put a 1-hour block on your calendar to triage This privilege escalation path is ridiculously trivial to identify and exploit. Don't ignore the other results of course, but if you have any ESC1, they are fix-immediately types of deals...

We built @ThinkstCanary for this. Some of the best security teams in the world use our Canaries && Canarytokens for this. (You can get pretty far with even just our free tokens at canarytokens.org)

Google / Mandiant linked this activity to ShinyHunters! cloud.google.com/blog/topics…

THIS Bad guys need a network connection to do bad stuff

Monitoring privileged groups (tier 0) for changes is super important but if you can get to a point where you’re also detecting abnormal changes, that’s better. Eg, if somehow joe the sql guy has added an account to Domain Admins even though he shouldn’t be able to, that’s a big red flag.

Am I weird or is a lot what was in the Anthropic September Threat Report (related to cybersecurity) not really all that surprising? That being said, one of the more interesting parts for me was how TA are beginning to use AI to streamline obfuscation and evasion. This is an area I think there will continue to be progress and developments made, for offsec people and for TA. offsec.blog/one-hacker-42-ta…

Inventory your service accounts, force unique passwords or certs, and disable or delete any that IT can't attribute.

There's a super disappointing trend happening as a result of AI. It's the lack of judgement and taste. If your AI agent does everything for you, analyzes everything for you, interprets everything for you, writes everything for you.... then what is it you're actually doing? Reviewing the output of some(thing)one else's work? Babysitting a cron job? I think this matters greatly in some areas and virtually not at all in others. I don't necessarily care how my AI agent writes a quick powershell script to do some small task or even a full blown tool to do some thing, so long as it does the thing I need it to do, correctly. But I certainly don't want it replacing my judgement and opinions and thoughts and perspectives on things that could materially impact an organization. Like say, the specifics of a pentest finding. Or the potential impact of that finding in the context of the environment and everything else I've found and discussions I’ve had with the client. Why would I want to leave that up for interpretation by an AI agent that has incomplete data no matter how much I try and feed it. Thats the ugly trend of offshoring all thinking and judgement and calling it "ok" because we're "reviewing the output." The review is likely just going to be as agreeable as the AI that fed the answers. The way you would write up a risk or a finding is not at all how an AI agent would right it up. I think that difference really matters. I don’t say this as a condemnation for using AI but more so of the complete offshoring of all thinking and judgment and taste and perspective. It’s a trap I’ve fallen into myself. In an effort to speed things up. So I write this even as a reminder to myself and to hold myself accountable to that. In a race to speed everything up and be more efficient we’re sacrificing so much of our judgment and perspective and our expertise. In the end I think it just makes everyone all sound the same and come to all the same conclusions.

💯👇