BREAKING THE ATTACK GRAPH:

HOW TO LEVERAGE GRAPHS TO
STRENGTHEN SECURITY IN A
DOMAIN ENVIRONMENTMARINA SIMAKOV

AGENDA• How attack tools use graphs & their limitations• BloodHound• GoFetch• How defenders can use graphs• Prevention: reduce attack surface• Detection: reconnaissance & lateral movement• Investigation

BLOODHOUND• Scans the network:• Local Administrators• Domain group memberships• Active sessions• ACLs• Finds shortest paths todomain admins
https://github.com/BloodHoundAD/BloodHound@_wald0, @CptJesus, and @harmj0y

GOFETCH• Automates the lateral movement process• Input:• A path generated by BloodHound• Output:• Domain admin credentials• The length of the path is not a factor
https://github.com/GoFetchAD/GoFetch@TalTheMaor

ATTACKERS VS. DEFENDERS
Permissions (datagathering)

ATTACKERS

DEFENDERS

Limited(domain user)

Unlimited

Access to network resources Limited(dependent on env &hardening)

Unlimited

GraphPartial

Full

ResultValuable insights &Complex attack paths

HOW CAN DEFENDERS USE GRAPHS?
Prevention• Detect vulnerablenodes:• Users• Computers• Disconnect them fromas many attack paths
as possible

Detection• Study logon patterns• Detect anomalies:• Reconnaissance• Lateral movement

Investigation• Discover the attackpath• Find additional
compromisedmachines\users

DATA SOURCES
1. Domain group memberships
2. Local group memberships on domain machines
3. Existing credentials on each machine (NTLM \ Kerberos)• Logon events (SIEM \ DC)• Network traffic to DC (successful AS & TGS requests)• No need to constantly query machines• Use a single data source

TGTKDC

AS/TGS REQAS/TGS REPPREVENTION
DETECTIONINVESTIGATIONPREVENTION• Goal: reduce attack surface• How:• Discover vulnerable nodes in the network• Disconnect them from as many attack paths as possible• Problem: Computing all the paths is hard
• Running time
• Resources• Constantly changing• Solution:• Compute only the last layers• Disconnect one of the last edges in the paths

PREVENTIONPREVENTIONPREVENTION: VULNERABLE NODES• Vulnerable node: a node which has a high probability of being
compromised during an attack

PREVENTION: VULNERABLE NODES• Vulnerable node: a node which has a high probability of being
compromised during an attack• Vulnerable Computer:• Has a session of a high privileged account• Has many low privileged accounts with local
admin privileges

PREVENTION: VULNERABLE NODES• Vulnerable node: a node which has a high probability of being
compromised during an attack• Vulnerable Computer:• Has a session of a high privileged account• Has many low privileged accounts with local
admin privileges• Vulnerable User:• A high privileged account• Has sessions on vulnerable computers

PREVENTION: VULNERABLE NODES• The status of a node can change based on:• User behavior• Computer configuration• Track the status of nodes over time

• What percentage of the time is the node considered vulnerable?
• Constant issue or a one-time occurrence?
• Rank the nodes by vulnerability• Secure the most vulnerable nodes• Deception – traps (Tom Sela, @4x6hw

https://www.youtube.com/watch?v=elf8NK1GR-M)• Disconnect the vulnerable nodes from the attack graph

PREVENTION: DISCONNECTING NODES
Configuration changesHow?

• Examine local admins
and their logon
patterns• Remove redundant
members

When?

• Machines with manyhigh privileged
sessions• Inactive local admins

PREVENTION: DISCONNECTING NODES
Configuration changes

Behavioral changes

How?

• Examine local admins • Network logon
and their logon• Logon to vulnerable
patterns
machine using a less
• Remove redundantprivileged accountmembers• Remote Cred-Guard• Log offWhen?

• Machines with manyhigh privileged
sessions• Inactive local admins• Ideally: always ☺

PREVENTION: DISCONNECTING NODES
Configuration changes

Behavioral changesActive monitoring*How?

• Examine local admins • Network logon
and their logon• Logon to vulnerable
patterns
machine using a less
• Remove redundantprivileged accountmembers• Remote Cred-Guard• Log off

• Disconnect inactive
sessions of highprivileged accounts

When?

• Machines with manyhigh privileged
sessions• Inactive local admins• A security solution
with admin privilegeson the machine• Ideally: always ☺

We can significantly reduce the attack surface.
However, we cannot remove it entirely.

PREVENTION
DETECTIONINVESTIGATION

DETECTION: LOGON GRAPH• Logon Graph 𝐺 = (𝑉, 𝐸):• 𝑉 = 𝑣1, 𝑣2, … , 𝑣𝑛 : Domain computers• 𝐸 = 𝑒1 , 𝑒2 , … , 𝑒𝑚 : Sessions• Each edge has a label• 𝑙 𝑒𝑖 = 𝑣𝑘 , 𝑣𝑙 = 𝑢𝑗 |𝑢𝑗 𝑖𝑠 𝑡ℎ𝑒 𝑑𝑜𝑚𝑎𝑖𝑛 𝑢𝑠𝑒𝑟 𝑤ℎ𝑖𝑐ℎ𝑐𝑜𝑛𝑛𝑒𝑐𝑡𝑒𝑑 𝑓𝑟𝑜𝑚 𝑣𝑘 𝑡𝑜 𝑣𝑙

DETECTION: WEIGHTED LOGON GRAPH• Weighted Logon Graph 𝐺 = (𝑉, 𝐸, 𝑤):• 𝑉 = 𝑣1, 𝑣2, … , 𝑣𝑛 : Domain computers• 𝐸 = {𝑒1 , 𝑒2 , … , 𝑒𝑚 }: Sessions• Each edge has a label & a weight• 𝑙 𝑒𝑖 = 𝑣𝑘 , 𝑣𝑙 = 𝑢𝑗 |𝑢𝑗 𝑖𝑠 𝑡ℎ𝑒 𝑑𝑜𝑚𝑎𝑖𝑛 𝑢𝑠𝑒𝑟 𝑤ℎ𝑖𝑐ℎ𝑐𝑜𝑛𝑛𝑒𝑐𝑡𝑒𝑑 𝑓𝑟𝑜𝑚 𝑣𝑘 𝑡𝑜 𝑣𝑙• 𝑤 𝑒𝑖 = 𝑣𝑘 , 𝑣𝑙 = 𝑃(𝑢𝑠𝑒𝑟 𝑢𝑗 𝑐𝑜𝑛𝑛𝑒𝑐𝑡𝑖𝑛𝑔𝑓𝑟𝑜𝑚 𝑣𝑘 𝑡𝑜 𝑣𝑙 )

DETECTION
1. Weighted Logon Graph: constructed based on logon activities
during a learning period• An edge 𝑒 = (𝑣𝑘 , 𝑣𝑙 ) is assigned a weight based on the logon activitiesof the corresponding user on 𝑣𝑘 , 𝑣𝑙

2. Daily Logon Graph: constructed based on logon activities during
the day and the Weighted Logon Graph• Construct a logon graph based on the daily logon activities• Delete edges which are assigned a high weight in the Weighted Graph

3. Detect anomalies on the Daily Logon Graph

DETECTION
Detecting anomalies:• Star structures• Reconnaissance activities• Main attack machine• Chains• Lateral movement• Combination

DETECTION
Detecting anomalies:• Star structures• Reconnaissance activities• Main attack machine• Chains• Lateral movement• Combination

DETECTION
Detecting anomalies:• Star structures• Reconnaissance activities• Main attack machine• Chains• Lateral movement• Combination

DETECTION: EXAMPLE• Try 1: Consider all suspicious edges

DETECTION: EXAMPLE• Try 2: Remove connected components consisting of 2 nodes(2 nodes connected by an edge without additional connections)DETECTION: EXAMPLE• Try 3: Separate “stars” structures from “chains”

DETECTION: EXAMPLE• Try 4: Add some more interesting features…
• New users & machines• Computer & resource popularity• Peers behavior

DETECTION: EXAMPLE• Try 5: Consider connections where the user is a local admin on thetarget machine• Result: Not too bad ☺

DETECTION: PROS & CONSPROSCONS

In order to fully avoid detection,attackers need to be aware of theentities’ behavior

If the attack corresponds to an entity’s
usual behavior, it would be harder todetect

Detect paths involving multiple users

Weight threshold:Too high: False Positives
Too low: might miss real attacks

Detect outsider & insider threats

Hard to detect “scattered attacks”

Can be incorporated with endpoint data
to strengthen certainty & eliminate FPs

PREVENTION
DETECTIONINVESTIGATIONINVESTIGATION
1. Input:• Known compromised machines• Known compromised users

2. Analysis:• Construct connection graphs for known
compromised entities

3. Output:• Information about the attack path
• Additional accounts which may have been compromised

CONCLUSIONS• Attackers have access to limited data sources• However, are still able to leverage graphs to gain insights into theenvironment & compromise high privileged accounts• Defenders have access to unlimited data sources• This data can be used to create very informative graphs to aid in:• Prevention• Detection• Investigation• Graphs are awesome

THANK YOU ☺