Tenable Blog

Active Directory has become the primary target for advanced cyberattacks and ransomware groups. Here's what you should consider when evaluating security vendors.

For more than 20 years, Active Directory has formed the backbone of digital infrastructure for organizations worldwide. When fully operational, its purpose goes beyond just governing authentication and passwords to managing the crucial access control rights for almost every organizational asset.

The Primary Group ID in Active Directory, created to help manage access to sensitive resources, has become a critical vulnerability that attackers can exploit to escalate privileges without leaving a trace.

Attackers can get into your Active Directory by leveraging the SDProp process and gaining privileges through the adminSDHolder object. Here's how to stop them.

Attackers use every possible trick and process they can to get into your Active Directory environment by moving laterally and gaining privileges. One such method is to leverage the Security Descriptor Propagation (SDProp) process and gain privileges through the adminSDHolder object.

Celebrating the elite defenders who are helping organizations around the world conquer their cyber risk. 

Cybersecurity is always a team effort. Day in, day out, defenders rely on an ecosystem of teams, partners and vendors to address the evolving threat landscape and deliver on a holistic security mission. The recent global shift to remote work, along with the continued adoption of cloud, IoT, mobile and DevOps technologies, has only underscored this need for collaboration. 

Threat actors are leveraging a zero-day vulnerability in Pulse Connect Secure, for which there is no immediate patch scheduled for release.

Update May 3, 2021: The Analysis and Solution sections have been updated to reflect the availability of a patch to address CVE-2021-22893 as well as three other vulnerabilities addressed as part of the same patch.