Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How to Defend Against Active Directory Attacks That Leave No Trace

semperis.com | blog | #siem | #active-directory | #detection | #group-policy | #zerologon | #dcshadow

Summary

Why some AD attacks leave no trace: DCShadow injects changes through the replication stream, malicious GPO edits like Ryuk's lack log detail, and ZeroLogon used crafted Netlogon messages—so SIEM-only monitoring misses them.
Published
Collected

original ↗

Related coverage

blog · semperis.com
AD Security 101: SIEM Tools and AD Monitoring
Why SIEMs alone can't secure AD monitoring: attackers bypass AD logs (DCShadow), and SIEMs face collection limits, configuration errors, processing gaps, stale threat intel, and false positives.
blog · semperis.com
Why Most Organizations Still Can’t Defend Against DCShadow – Part 2
Defending against DCShadow (part 2): test in isolated labs, watch privileged access, and alert on transient server objects under CN=Sites,CN=Configuration—registration artifacts it leaves behind.
blog · netspi.com
3 Lessons Learned from Simulating Attacks in the Cloud
Lessons from NetSPI's cloud attack simulations: default cloud logging alone is insufficient, SIEM rules need tuning, and breach and attack simulation (BAS) helps validate detective controls in Azure.
blog · semperis.com
How to Redefine Cyber Resilience: Start by Rethinking Hybrid Identity Protection
Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.
blog · semperis.com
Effective GPO Change Auditing with Directory Services Protector
With many GPOs across large AD environments, critical changes can slip under the radar. DSP simplifies GPO change auditing, alerts on suspicious edits, and helps restore altered policies.
blog · semperis.com
Group Policy Abuse Explained
Group Policy abuse lets attackers with GPO write access push malware as SYSTEM, disable security settings, or plant backdoors. The post covers a SharpGPOAbuse scenario and Purple Knight detection.
back