Active Directory Privilege Escalation Path Identifier

Capability Summary

Active Directory Privilege Escalation Path Identifier is the only solution in the world that can accurately identify privilege esclation paths in Active Directory, because it is the world's only solution that actually identifies privilege escalation paths in Active Directory based on the determination of effective permissions in Active Directory.

It can instantly and accurately identify all privilege escalation paths leading to any Active Directory object.

Saliently -

1. It can identify exactly which entities have a privilege escalation path to an Active Directory object

2. It can identify exactly which actions each such entity can perform to escalate privilege to the target

3. It can identify exactly which underlying security permission in the target's ACL enable the escalation

It can* optionally also automatically identify privilege escalation paths on multiple objects in any Active Directory tree.

In essence, it is the world's only solution that can accurately make these paramount determinatons, and it can do all this instantly, at a button's touch, without requiring any admin access or changes to Active Directory.

The Paramount Difference

Accuracy powered by Effective Permissions

The cardinal and paramount tenet in the identification of privilege escalation paths in Active Directory is accuracy, and the only way to achieve accuracy in escalation path identification is by determining effective permissions in Active Directory.

(After all, of what use is inaccurate privilege escalation insight?)

Active Directory Effective Permissions are the actual (resulting) set of permissions that a user is actually granted (i.e. allowed) on an Active Directory object, in light of accurately considering the collective impact of all (i.e. Allow, Deny, Explicit, Inherited) the security permissions specified in the access control list (ACL) of that Active Directory object.

Cardinally, it is not "Who has what permissions in Active Directory" but in fact "Who has what effective permissions in Active Directory" that determines who actually has what privileged access on every single object in Active Directory.

Consequently, the only way to accuratley identify privilege escalation paths in Active Directory is by determining who has what effective permissions on the target Active Directory object and subsequently on all identified escalation subjects.

Active Directory Privilege Escalation Path Identifier is the world's only solution that actually identifies privilege escalation paths in Active Directory based on the determination of effective permissions in Active Directory.

Paramount Insights

Active Directory Privilege Escalation Path Identifier accurately and instantly delivers three indispensable privilege escalation insights that enable organizational IT personnel to quickly identify and eliminate privilege escalation paths -

1. Exactly which entities have a privilege escalation path to a specific target Active Directory object

2. Exactly which actions (tasks) can each such entity perform to escalate their privilege to the target

3. Exactly which underlying security permissions in the target object's ACL enables these privilege escalations

Armed with these three unrivaled indispensable insights, organizational IT personnel can instantly enact risk mitigation steps to lockdown all such identified access in Active Directory that is currently enabling all existing escalation paths.

[ These insights are accurately identified and provided for each and every escalation path in the escalation path graph. ]

Accuracy is Paramount

There are certain fields in the world today, such as a surgeon performing heart surgery, or a nation's military conducting precision strikes on its adversaries, where accuracy is absolutely paramount and there is absolutely no room for error.

The identification of privilege escalation paths in Active Directory is one such field where accuracy is paramount.

The reason accuracy is paramount in this endeavor is because a perpetrator needs only one high-value exploitable privilege escalation path to gain and subsequently exploit the most powerful privileged access in an organization.

Literally, just one.

A proficient adversary that could gain the most powerful privileged access in an organization could cause substantial irreverible damage, such as compromising all organizaitonal identities and endpoints, exfiltrating oceans of confidential organizational data, unleashing ransomware organization-wide and automating the destruction of the entire organization.

One exploitable privilege escalation path in Active Directory is all that the perpetrator needs to be able to do so. Just one.

In essence, when the stakes are so high, and everything could be at stake, there is just no room for error when it comes to accurately identifying privilege escalation paths in Active Directory. None whatsover.

Achieving Accuracy -
A Real-world Example

Now consider a real-world example, so assume that a user John Doe is a member of multiple (e.g. 20+) domain security groups, many of which are members of other security groups, some of which are circularly nested.

Further assume that there are 50 permissions in the ACL protecting the CEO's domain user account in Active Directory -

1. Explicit   Deny IT Contractors  Special

2. Explicit   Allow Domain Admins Full Control

   ...

49. Inherited Deny Helpdesk Team All Extended Rights

50. Inherited Allow Global Admins Reset Password

Question: Will John Doe be able to reset the CEO's password? (i.e. does he have an escalation path to the CEO?)

Correct Answer: To correctly answer this question, one needs to accurately take into account the collective impact of 50 permissions in the ACL, which involves correctly expanding 50+ security groups, dynamically evaluating well-known security principals, intersecting all conflicting permissions (Allow, Deny) in light of precedence orders etc. etc., a process known as determining effective permissions in Active Directory

A Simple Litmus Test