Microsoft has shared guidance to help admins defend their Windows enterprise environments against KrbRelayUp attacks that enable attackers to gain SYSTEM privileges on Windows systems with default configurations.
Attackers can launch this attack using the KrbRelayUp tool developed by security researcher Mor Davidovich as an open-source wrapper for Rubeus, KrbRelay, SCMUACBypass, PowerMad/SharpMad, Whisker, and ADCSPwn privilege escalation tools.
Since late April 2022, when the tool was first shared on GitHub, threat actors could escalate their permissions to SYSTEM in Windows domain environments with default settings (where LDAP signing is not enforced).
Also Read: Top 9 Proper Guidelines on How to Make Data Transfer Agreement Template
Microsoft says that this privilege escalation tool doesn’t work against organizations with cloud-based Azure Active Directory environments.
However, KrbRelayUp can help compromise Azure virtual machines in hybrid AD environments where domain controllers are synchronized with Azure AD.
“Although this attack won’t function for Azure Active Directory (Azure AD) joined devices, hybrid joined devices with on-premises domain controllers remain vulnerable,” said Zeev Rabinovich and Ofir Shlomo of the Microsoft 365 Defender Research Team.
“If an attacker compromises an Azure virtual machine using a synchronized account, they’ll receive SYSTEM privileges on the virtual machine.”
KrbRelayUp demo (Mor Davidovich)
Microsoft has now publicly shared guidance on blocking such attempts and defending corporate networks from attacks that use the KrbRelayUp wrapper.
Also Read: 5 ways on how to destroy documents securely to prevent data breach
However, these mitigation measures have also been available before this for enterprise customers with Microsoft 365 E5 subscriptions.
Per Redmond’s recommendations, admins have to secure communications between LDAP clients and Active Directory (AD) domain controllers by enforcing LDAP server signing and enabling Extended Protection for Authentication (EPA).
As Microsoft said, organizations are advised to apply the following mitigations to “reduce the impact of this threat:”
The Microsoft 365 Defender Research Team provides additional details on how the KrbRelayUp attack works and further info on how to strengthen device configurations here.
Importance of Efficient Access Controls that every Organisation in Singapore should take note of. Enhancing…
Prioritizing Security Measures When Launching a Webpage That Every Organisation in Singapore should take note…
Importance of Regularly Changing Passwords for Enhance Online Security that every Organisation in Singapore should…
Comprehensive Approach to Data Protection and Operational Integrity that every Organsiation in Singapore should know…
Here's the importance of Pre-Launch Testing in IT Systems Implementation for Organisations in Singapore. The…
Understanding Liability in IT Vendor Relationships that every Organisation in Singapore should look at. Understanding…
This website uses cookies.