New Blog: Azure Advanced Threat Protection - CredSSP Exploit Analysis

[Jason Wilson]

After announcing the release of Azure Advanced Threat Protection (Azure ATP) last month, we are excited to provide details on how Azure ATP has been updated to better protect customers against a new exploit by including the identity theft technique used in the Credential Security Support Provider (CredSSP) Protocol exploit as a flavor of the Pass-The-Ticket detection.

In the blog, the Azure ATP team provides network behavior analysis of the CredSSP exploitation of this vulnerability and the techniques it uses to propagate in the network. They also highlight how you can use Azure ATP to detect and investigate a variety of advanced cyberattacks.

You can read the blog post here. 

[#2]

In Azure ATP,  you can see lateral movement maps giving you an idea how hackers can move from hop to hop to reach sensitive accounts.

My question, how can Azure ATP know that if John has a compromised identity, that he can access that TS because he is member of this group. How Azure ATP can know who is the administrators group on servers to do such simulation and map? because when John gets his TGT, it has list of what groups he is member of, and not a list of servers that those groups are set as administrates.

[#3]

https://techcommunity.microsoft.com/t5/Microsoft-Advanced-Threat/Azure-ATP-lateral-Movement/m-p/1858...