Active Directory
How to detect and respond to a Password Extraction attack (ntds.dit access) using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect a potential Password Extraction attack, specifically the ...
How to detect and respond to a Password Spraying attack using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect a potential Password Spraying attack, understand the immediate ...
How to detect and respond to Reversible Password Encryption being enabled using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect when the "Store password using reversible encryption" setting is ...
How to detect and respond to Plaintext Passwords in GPOs using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect the insecure storage of passwords in Group Policy Objects (GPOs), ...
How to detect and respond to a Brute-force Password attack using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect a potential Brute-force Password attack, understand the immediate ...
How to detect and respond to a Brute-force Username Detection attack using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect a potential Brute-force Username Detection (user enumeration) ...
How to detect and respond to a DSRM Password Change using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect when the Directory Services Restore Mode (DSRM) password is ...
How to detect and respond to a DNS Admin Escalation attack using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect a potential DNS Admin privilege escalation attack based on Sysmon ...
How to detect and respond to a suspicious process alert using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect a potential threat based on the execution of a suspicious process, ...
How to detect and respond to a remote thread creation attack using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect a potential Remote Thread Creation attack based on System Monitor ...
How to detect and respond to a ransomware attack using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect a potential ransomware attack based on mass file modification ...
How to detect and respond to an AdminSDHolder attack using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect an AdminSDHolder attack, take the immediate remediation steps, and ...
How to detect and respond to a DCShadow attack using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect a DCShadow attack, take immediate remediation steps, and implement ...
How to detect and respond to a Pass-the-Hash attack using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect a pass-the-hash (PTH) attack, understand the immediate remediation ...
How to detect and respond to a DCSync attack using ADAudit Plus
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article explains how to use ADAudit Plus to detect a DCSync attack, understand the immediate remediation steps ...
How to configure Attack Surface Analyzer for Active Directory
In this article: Objective Prerequisites Steps to follow Validation and confirmation Tips Related topics and articles Objective This article provides a step-by-step guide to configure the Attack Surface Analyzer for Active Directory environments. It ...
Troubleshooting DCSync attacks not being detected by ADAudit Plus
In this article: Issue description Prerequisites Possible causes Resolution How to reach support Related topics and articles Issue description An event related to a DCSync attack is not being detected by ADAudit Plus. The activity is not found under ...