Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
Certsync is an attack tool that enables attackers to easily compromise AD environments. To successfully run Certsync, an attacker must have internal network access and the Active Directory (AD) environment must have implemented AD Certificate Services (AD CS). A successful exploit can lead to stolen credentials and further attacks on your network.
Kill Chain
Risk Score
83
After a device has been compromised, an attacker can run Certsync to query LDAP to retrieve a set of users in the Active Directory domain and locate the AD CS server. Certsync creates a service on the AD CS server by sending a Microsoft remote procedure call (MS-RPC) request and receiving an MS-RPC response, which grants the attacker access to the certificate server’s private key. Certsync then remotely copies the private key and forges a new authentication certificate for each enumerated user. The attacker can perform the UnPAC-the-Hash technique to steal NTLM hashes and perform additional attacks, such as pass-the-hash, to access services and devices.
Secure certificate authorities (CA)
Secure certificates and private keys
