Impacts
The Impacts page groups issues by impact. Use it to plan a remediation roadmap against whole attacks, not only single vulnerabilities. Each impact shows its Exposure Points and Risk level, so you can start with the most critical ones.
The provider selector at the top right chooses whether the page lists the impacts of Active Directory, Azure, AWS, GCP or GitHub findings. Only providers with findings in the selected scan can be selected. The others are listed under Not in this scan with No findings.
Each card contains Impact Name as a header, with the impact's Risk percentage and Total Exposure Point on the right, and lists of issues that contain Severity, Ease of Mitigation, Tags, and Exposure Points. Cards are sorted by the risk of impact and issues are sorted by the Ease of Mitigation metric.
Active Directory issues are mapped to the Impacts below. The cloud and GitHub impacts are listed under Cloud and GitHub Impacts.
Account Management Issues
Issues that complicate the account management lifecycle and inventory management.
Credential Theft Attacks
Issues that exposed account credentials/sessions in different ways to a possible breach.
AS-REP Roasting
Issues related to a special Kerberos protocol attack vector named AS-REP Roasting.
Exploitation of Unpatched Services
Issues that lead to exploitation of old/unsupported or unpatched versions of services like NETLOGON, RDP, KDC etc.
Exploitation of SMB Protocol
Issues that lead to exploitation of old/unsupported, unpatched, or misconfigured versions of SMB Protocol.
NTLM Relay
Issues related to a special NTLM protocol attack vector named NTLM Relay.
Unconstrained Delegation Exploitation
Issues that lead to exploitation of an insecure way of delegation.
Reconnaissance with Shared Files
Issues that lead to information-gathering attacks through shared files with misconfigured/broad access control entries.
Resource Based Constrained Delegation Exploitation
Issues (backdoors) that lead to exploitation of misconfigured Resource-Based Constrained Delegation method.
Reconnaissance with Null Session
Issues that lead to information-gathering attacks through misconfigured SMB protocol.
Persistence with PrimaryGroupID Modification
Issues related to suspicious modification of PrimaryGroupID attribute to ensure persistence.
Delegation Exploitation
Issues related to precautions about exploitations of multiple delegation methods.
Plaintext Password Extraction from GPP
Issues that exposed generally local administrator account credentials as plain text to everyone in the domain through Group Policy Preferences.
Kerberoasting
Issues related to a special Kerberos protocol attack vector named Kerberoasting.
Golden Ticket
Issues related to precautions about special Kerberos persistence attack vector named Golden Ticket.
Misconfigured Privilege Exploitation
Issues related to misconfigured privileges that break the tiering model which are mostly caused by group memberships and service management.
ACL Based Attack Path Exploitation
Issues that create so many attack paths because of misconfigured/broad access control entry definitions.
Business Continuity Issues
Issues that affect the availability and resilience of the Active Directory.
Privilege Escalation with Builtin Groups
Issues that lead to privilege escalation paths through builtin privileged group memberships.
Persistence with Access Control Entries
Issues related to suspicious modification of access control entries on important objects to ensure persistence.
GPO Management Issues
Issues that complicate the Group Policy lifecycle and inventory management.
PrivExchange
Issues related to Exchange Service and NTLM attack vector that leads to privilege escalation and total domain compromise.
Persistence with SID-History Injection
Issues related to suspicious modification of SIDHistory attributes of objects to ensure persistence.
Reconnaissance with LDAP Protocol
Issues that lead to information-gathering attacks through LDAP protocol which are caused by misconfiguration of the dSHeuristics attribute.
Reconnaissance with NSPI Protocol
Issues that lead to information-gathering attacks through NSPI protocol which are caused by misconfiguration of the dSHeuristics attribute.
Constrained Delegation Exploitation
Issues that lead to exploitation of misconfigured Constrained Delegation method.
Privilege Escalation with Certificate Template Abuse
Issues that lead to privilege escalation through the exploitation of misconfigured Certificate Templates.
Privilege Escalation with Certificate Authority Abuse
Issues that lead to privilege escalation through the exploitation of misconfigured Certificate Authorities.
Privilege Escalation with Certificate Service Abuse
Issues that lead to privilege escalation through the exploitation of misconfigured Certificate Enrollment Services.
Domain Compromise Through Netlogon Secure Channel Allow List
Issues related to a vulnerable Netlogon secure channel allow list on domain controllers that can lead to domain compromise.
Privilege Escalation with Explicit Certificate Mapping Collision
Issues where privileged or admin objects have explicit certificate mappings that collide with other objects. The collision can be used for privilege escalation.
Account Impersonation with Explicit Certificate Mapping Collision
Issues where non-privileged objects have colliding explicit certificate mappings. The collision can be used to impersonate an account.
Weak Explicit Certificate Mapping on Privileged Objects
Issues where privileged or admin objects use weak explicit certificate mappings.
Weak Explicit Certificate Mapping on Non-Privileged Objects
Issues where non-privileged objects use weak explicit certificate mappings.
Persistence with Replication
Issues related to rogue domain controller service principal names that can be used to maintain persistence through replication.
Persistence with UserAccountControl Modification
Issues related to suspicious modification of the UserAccountControl attribute, such as the SERVER_TRUST_ACCOUNT bit, to maintain persistence.
Cloud and GitHub Impacts
Azure, AWS, GCP and GitHub findings are grouped by their own impacts. Only impacts with at least one finding in the selected scan are shown. Examples:
Azure: Data Exposure, Privileged Access Management, Unauthorized Access, Resource Tier 0 Managed Identity, Service Principal Privileged Role Assignment, Inactive Privileged Identity, Overprivileged Custom Role, Service Principal Ownership Abuse, Key Vault Identity Access.
AWS: Privileged Access Management, Account Management Issues, Account Takeover, Credential Management Issues.
GCP: Privileged Access Management, Unauthorized Access, Privilege Escalation, Account Management Issues, Credential Management Issues, Monitoring Risk.
GitHub: Account Management Issues, Privilege Management Issues, Supply Chain Attack Risk, Security Monitoring Gap.
Last updated
Was this helpful?