> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/impacts.md). # Impacts The Impacts page groups issues by impact. Use it to plan a remediation roadmap against whole attacks, not only single vulnerabilities. Each impact shows its Exposure Points and Risk level, so you can start with the most critical ones.
Impacts page with the provider selector and impact cards

Impact List

The provider selector at the top right chooses whether the page lists the impacts of Active Directory, Azure, AWS, GCP or GitHub findings. Only providers with findings in the selected scan can be selected. The others are listed under `Not in this scan` with `No findings`. Each card contains `Impact Name` as a header, with the impact's **Risk** percentage and **Total Exposure Point** on the right, and lists of issues that contain `Severity`, `Ease of Mitigation`, `Tags`, and `Exposure Points`. Cards are sorted by the risk of impact and issues are sorted by the `Ease of Mitigation` metric. Active Directory issues are mapped to the Impacts below. The cloud and GitHub impacts are listed under [Cloud and GitHub Impacts](#cloud-and-github-impacts). ## **Account Management Issues** Issues that complicate the account management lifecycle and inventory management. ## **Credential Theft Attacks** Issues that exposed account credentials/sessions in different ways to a possible breach. ## **AS-REP Roasting** Issues related to a special Kerberos protocol attack vector named AS-REP Roasting. ## **Exploitation of Unpatched Services** Issues that lead to exploitation of old/unsupported or unpatched versions of services like NETLOGON, RDP, KDC etc. ## **Exploitation of SMB Protocol** Issues that lead to exploitation of old/unsupported, unpatched, or misconfigured versions of SMB Protocol. ## **NTLM Relay** Issues related to a special NTLM protocol attack vector named NTLM Relay. ## **Unconstrained Delegation Exploitation** Issues that lead to exploitation of an insecure way of delegation. ## **Reconnaissance with Shared Files** Issues that lead to information-gathering attacks through shared files with misconfigured/broad access control entries. ## **Resource Based Constrained Delegation Exploitation** Issues (backdoors) that lead to exploitation of misconfigured Resource-Based Constrained Delegation method. ## **Reconnaissance with Null Session** Issues that lead to information-gathering attacks through misconfigured SMB protocol. ## **Persistence with PrimaryGroupID Modification** Issues related to suspicious modification of PrimaryGroupID attribute to ensure persistence. ## **Delegation Exploitation** Issues related to precautions about exploitations of multiple delegation methods. ## **Plaintext Password Extraction from GPP** Issues that exposed generally local administrator account credentials as plain text to everyone in the domain through Group Policy Preferences. ## **Kerberoasting** Issues related to a special Kerberos protocol attack vector named Kerberoasting. ## **Golden Ticket** Issues related to precautions about special Kerberos persistence attack vector named Golden Ticket. ## **Misconfigured Privilege Exploitation** Issues related to misconfigured privileges that break the tiering model which are mostly caused by group memberships and service management. ## **ACL Based Attack Path Exploitation** Issues that create so many attack paths because of misconfigured/broad access control entry definitions. ## **Business Continuity Issues** Issues that affect the availability and resilience of the Active Directory. ## **Privilege Escalation with Builtin Groups** Issues that lead to privilege escalation paths through builtin privileged group memberships. ## **Persistence with Access Control Entries** Issues related to suspicious modification of access control entries on important objects to ensure persistence. ## **GPO Management Issues** Issues that complicate the Group Policy lifecycle and inventory management. ## **PrivExchange** Issues related to Exchange Service and NTLM attack vector that leads to privilege escalation and total domain compromise. ## **Persistence with SID-History Injection** Issues related to suspicious modification of SIDHistory attributes of objects to ensure persistence. ## **Reconnaissance with LDAP Protocol** Issues that lead to information-gathering attacks through LDAP protocol which are caused by misconfiguration of the dSHeuristics attribute. ## **Reconnaissance with NSPI Protocol** Issues that lead to information-gathering attacks through NSPI protocol which are caused by misconfiguration of the dSHeuristics attribute. ## **Constrained Delegation Exploitation** Issues that lead to exploitation of misconfigured Constrained Delegation method. ## **Privilege Escalation with Certificate Template Abuse** Issues that lead to privilege escalation through the exploitation of misconfigured Certificate Templates. ## **Privilege Escalation with Certificate Authority Abuse** Issues that lead to privilege escalation through the exploitation of misconfigured Certificate Authorities. ## **Privilege Escalation with Certificate Service Abuse** Issues that lead to privilege escalation through the exploitation of misconfigured Certificate Enrollment Services. ## **Domain Compromise Through Netlogon Secure Channel Allow List** Issues related to a vulnerable Netlogon secure channel allow list on domain controllers that can lead to domain compromise. ## **Privilege Escalation with Explicit Certificate Mapping Collision** Issues where privileged or admin objects have explicit certificate mappings that collide with other objects. The collision can be used for privilege escalation. ## **Account Impersonation with Explicit Certificate Mapping Collision** Issues where non-privileged objects have colliding explicit certificate mappings. The collision can be used to impersonate an account. ## **Weak Explicit Certificate Mapping on Privileged Objects** Issues where privileged or admin objects use weak explicit certificate mappings. ## **Weak Explicit Certificate Mapping on Non-Privileged Objects** Issues where non-privileged objects use weak explicit certificate mappings. ## **Persistence with Replication** Issues related to rogue domain controller service principal names that can be used to maintain persistence through replication. ## **Persistence with UserAccountControl Modification** Issues related to suspicious modification of the UserAccountControl attribute, such as the SERVER\_TRUST\_ACCOUNT bit, to maintain persistence. ## Cloud and GitHub Impacts Azure, AWS, GCP and GitHub findings are grouped by their own impacts. Only impacts with at least one finding in the selected scan are shown. Examples: * **Azure:** Data Exposure, Privileged Access Management, Unauthorized Access, Resource Tier 0 Managed Identity, Service Principal Privileged Role Assignment, Inactive Privileged Identity, Overprivileged Custom Role, Service Principal Ownership Abuse, Key Vault Identity Access. * **AWS:** Privileged Access Management, Account Management Issues, Account Takeover, Credential Management Issues. * **GCP:** Privileged Access Management, Unauthorized Access, Privilege Escalation, Account Management Issues, Credential Management Issues, Monitoring Risk. * **GitHub:** Account Management Issues, Privilege Management Issues, Supply Chain Attack Risk, Security Monitoring Gap.