Active Directory attackers steal password hashes
Attackers are stealing password hashes from Active Directory networks without directly attacking the servers that control them. This lets them break into accounts without needing to crack the passwords themselves.
- Report priority
- Medium
How it works
- Attackers use a method called DCSync to trick Active Directory into giving them copies of password hashes.
- They do this by pretending to be a trusted server and asking for updates to the directory.
- The system then sends the hashes, which the attackers can use to log in as other users without knowing their real passwords.
What to do
If your company uses Microsoft Active Directory and has Windows Server domain controllers, check if any user accounts have been given too many permissions. Attackers need special access to steal password hashes this way. Look for unusual logins or account activity in your security logs.
Restrict which accounts can run DCSync commands. Use Microsoft's built-in tools to audit and limit domain controller access. Check Microsoft's security updates for patches that prevent this attack. If you suspect an attack, reset all passwords and review your security logs for signs of unauthorized access.
Technical details
Threat actors are increasingly exploiting Active Directory replication mechanisms to steal password hashes without directly compromising a domain controller. This technique, known as DCSync, allows attackers with privileged domain credentials to impersonate a legitimate domain controller and request sensitive directory replication data.