{"id":6502,"date":"2022-09-15T07:59:43","date_gmt":"2022-09-15T05:59:43","guid":{"rendered":"https:\/\/www.teal-consulting.de\/?p=6502"},"modified":"2022-09-15T09:08:06","modified_gmt":"2022-09-15T07:08:06","slug":"secure-azure-on-prem","status":"publish","type":"post","link":"https:\/\/www.teal-consulting.de\/en\/2022\/09\/15\/secure-azure-on-prem\/","title":{"rendered":"Secure your Azure and On-Prem environments!"},"content":{"rendered":"
[vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”30″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text][\/vc_column_text][vc_empty_space height=”20″][vc_column_text]\"\"In March of this year, we announced our partnership with Specterops<\/a>, and since then at the latest, the topic of Attack Path Management (APM) and BloodHound Enterprise has been very much with us. We have already launched some joint activities, such as our webinar<\/a>, or a joint blog<\/a> article. Our T-shirt campaign, with which we wanted to make a small contribution to the management of the Ukraine crisis, was also a great event that we look back on with pleasure.<\/p>\n

In addition to the planned actions, we also regularly work together on customer inquiries, demos or troubleshooting around BloodHound Enterprise.<\/p>\n

In this blog article we would like to talk about how easy it is to try BloodHound Enterprise and get convinced of its numerous benefits. We’ll explain the requirements for a free trial and how you can get the most out of it.<\/strong>[\/vc_column_text][vc_empty_space height=”30″][vc_column_text]\n

What is BloodHound Enterprise?<\/h2>\n

BloodHound Enterprise is a tool that identifies attack paths and provides assistance in resolving them. Attack paths are nothing new \u276f identity-based attack paths have long been common knowledge and are analyzed in depth by both attackers and defenders. You can see an example of an attack path here:<\/p>\n

\"\"<\/p>\n

BloodHound Enterprise is an “Attack Path Management” tool whose methodology enables organizations to understand attack path risks, empirically quantify their impact, and eliminate them. The primary goal of APM is to directly resolve attack paths, as they are a huge problem in the Microsoft Active Directory and Azure Active Directory world. These services are the most lucrative for attackers because control of an enterprise is enabled by the controllers of these systems.<\/p>\n

How does BloodHound Enterprise work?<\/h2>\n

BloodHound Enterprise is a cloud solution that automatically analyzes and prioritizes existing data in an environment and identifies possible solutions.<\/p>\n

Attack paths can thus be reported and remediated quickly and in near real-time.<\/p>\n

\"\"<\/p>\n

In order for the data to be analyzed, the environment must be connected to the BloodHound Enterprise Tenant. It is possible to connect multiple Active Directory or Azure Cloud environments. Let’s first look at how one would connect an on-prem AD structure.<\/p>\n

ON-PREM connection<\/h3>\n

\"\"<\/p>\n

Those who have studied the open source variant of Bloodhound in depth will already be familiar with the SharpHound Data Collector. Bloodhound Enterprise collects the data with the help of the SharpHound Enterprise Service. One or more collectors can be installed on different Windows machines. These connectors then establish an outbound connection via port 443 to the BloodHound Enterprise tenant. The connection is appropriately secured via TLS1.2.<\/p>\n

To read out the environment data, a distinction must be made between two data types. On the one hand there is so-called “AD Structure<\/strong>” data and on the other hand “Privileged<\/strong>” data.<\/p>\n

AD structure data<\/h3>\n

This data contains all AD objects that are located in the Active Directory database. E.g. users, groups or computer accounts, but also OU or GPO objects. To be able to collect this data, the SharpHound service must be able to talk to any domain controller via port 389. The data itself is by default available for reading to any authenticated user. It is therefore sufficient to grant the service account “normal” domain user permissions for this.<\/p>\n

\"\"<\/p>\n

Privileged Data<\/h3>\n

\"\"The situation is somewhat different with the so-called Privileged Collection, where both the local group memberships and the active logon connections are to be read out from each domain member, i.e. servers, clients, tablets, etc. The Privileged Collection is also used to analyze the active connections. Especially the active connections are very important for the attack path analysis. If, for example, a highly privileged account is logged on to a “normal” end user system, this often results in completely new attack paths that would not have been possible without this incorrect logon.<\/p>\n

\"\"<\/p>\n

Depending on the Windows version, local administrator rights are required for these queries. Systems < Windows 10 build 1809 still give this information to any authenticated user.<\/p>\n

It is a bit tricky to give a single user local admin permissions on all server and client systems. Therefore, we recommend the following solution option for productive use.<\/p>\n

A dedicated SharpHound agent is installed for each tiering stage. For each stage a separate user is configured, who has local admin rights on the respective systems. This ensures that, for example, Tier0 systems are scanned by a Tier0 user and Tier1 systems are scanned by a Tier1 user. This approach greatly reduces the importance of SharpHound service accounts and provides the ability to process relevant data in a tiering-compliant manner.<\/p>\n

To connect the local agent to the BloodHound Enterprise Tenant, an agent must be created in the tenant and a unique key must be stored in the local client. In addition, it is specified which data is to be collected and how often.<\/p>\n

AZURE connection<\/h2>\n

The connection to an Azure environment, is handled by the AzureHound service. The AzureHound Enterprise service collects data about the Azure environment and uploads it to the BloodHound Enterprise instance for processing and analysis.<\/p>\n

AzureHound Enterprise is typically deployed on a single Windows system per Azure tenant and can run on the same system as the SharpHound Enterprise service.<\/p>\n

Network connections via port 443 to the BloodHound and Azure tenant are required for operation. Again, traffic is protected using TLS.<\/p>\n

Within Azure, read permissions to the Azure AD Tenant, Azure Subscription and Directory ReadAll permissions in Microsoft Graph are required.<\/p>\n

The installation itself consists of the following elements:<\/p>\n