{"id":7729,"date":"2023-07-17T08:00:48","date_gmt":"2023-07-17T06:00:48","guid":{"rendered":"https:\/\/www.teal-consulting.de\/?p=7729"},"modified":"2023-08-29T10:57:57","modified_gmt":"2023-08-29T08:57:57","slug":"troopers-conference-recap","status":"publish","type":"post","link":"https:\/\/www.teal-consulting.de\/en\/2023\/07\/17\/troopers-conference-recap\/","title":{"rendered":"Troopers Conference Recap: ACL-based Active Directory Attacks and Defenses"},"content":{"rendered":"
[vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”30″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text][\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_empty_space height=”30″][vc_column_text]Last month was the first time Teal was a speaker at the Troopers 23<\/a> Security Conference in Heidelberg, Germany. In this blog post, we would like to share the topic we presented with a wider audience. We strongly believe that a layered security structure can improve IT security in the long run. However, there are a few issues to consider and these are exactly what we would like to share here.<\/p>\n

But first, what are the troops? Hardcore security enthusiasts will probably be familiar with it, but probably not everyone. Troopers is an annual security conference in Heidelberg, Germany, where IT security topics are discussed in depth in training sessions, lectures, and roundtables. Active Directory security topics are always on the agenda. The speakers are also internationally recognized. For example, Sean Metcalf (Mr. AD Security \ud83d\ude0a Sean Metcalf – Active Directory Security (adsecurity.org)<\/a>), but also our partner company SpecterOps has already held presentations there.<\/p>\n

Reason enough for us to want to be there as well. That’s why we submitted a presentation together with our friends from SpecterOps<\/a> in early 2023 – and to our delight, it was quickly accepted.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text]\n

Our topic \u2013 Hidden Pathways: Exploring the Anatomy of ACL-Based Active Directory Attacks and Building Strong Defenses<\/h2>\n[\/vc_column_text][vc_empty_space height=”30″][vc_column_text]While brainstorming with SpecterOps, we quickly realized the potential to combine our respective strengths and provide valuable value to our audience. SpecterOps, through BloodHound and BloodHound Enterprise<\/a>, specializes in discovering attack vectors, visualizing them, and presenting technical information as a defense. Teal helps clients evaluate and improve management processes and architectures to reduce the attack surface and minimize the impact of a successful attack.<\/p>\n

From a purely technical perspective, it is “easy” to close an attack vector by removing a privilege, for example. However, in a complex IT infrastructure that has grown over time, it is often very difficult to make changes “on the fly” without good preparation. This is where we come in and help our customers. The goal is to adapt processes and behaviors so that the operations team can be involved and security measures can be implemented appropriately.[\/vc_column_text][vc_empty_space height=”50″][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern” z_index=”” background_color=”#ededed”][vc_column][vc_empty_space height=”50″][vc_row_inner row_type=”row” type=”full_width” text_align=”left” css_animation=””][vc_column_inner][vc_column_text]\n

The complete recorded presentation<\/h2>\n[\/vc_column_text][vc_empty_space height=”30″][vc_video link=”https:\/\/www.youtube.com\/watch?v=4aQZUdpmQno” el_width=”80″ align=”center” css_animation=”fadeInDown”][vc_empty_space height=”50″][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_column_text]\n

Let’s start with the theme of the previous day – really \ud83d\ude0a<\/h2>\n[\/vc_column_text][vc_empty_space height=”30″][vc_column_text]After an admittedly somewhat lengthy introduction, let’s get down to business.<\/p>\n

In Active Directory, there are both standard permissions and historically grown misconfigurations that an attacker can exploit. First, we will briefly explain how permissions work in AD, then we will describe why this well-known topic is still relevant today, and finally we will present our solution approach.[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=”” row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” angled_section=”no” text_align=”left” background_image_as_pattern=”without_pattern”][vc_column][vc_empty_space height=”50″][vc_column_text]\n

What are AD ACLs \/ ACEs?<\/h2>\n[\/vc_column_text][vc_empty_space height=”30″][vc_column_text]Every object in Active Directory has an Access Control List (ACL). Just like in the NTFS file system, the ACL describes “who can do what”. The ACL is composed of individual Access Control Entries (ACEs) that define an atomic permission. This then looks like this:<\/p>\n

\"\"<\/p>\n

The user object “Andy” has an ACL that is composed of 32 ACEs. To give some examples:<\/p>\n