Domain Admin

An AD password audit replayed one breached password. j.okonkwo logged on. MFA was not required.

Open path

StartPassword audit
WeaknessCredential stuffing
Credentialj.okonkwo
ImpactDomain Admin

Fix that breaks this chain

Reset the breached Domain Admin

Rotate j.okonkwo and require phishing-resistant MFA. This is the second way into Domain Admin.

Proof on each hop

1. Password audit
Read-only check against known-breached secrets.

2. Credential stuffing

One replay was accepted.

principal: j.okonkwo
group: Domain Admins
source: a password from a prior breach, replayed once
password: [redacted]
DC-01: logon accepted
MFA: not required for this account
Sentinel: no alert

Fix. Reset the password, require phishing-resistant MFA, and alert on Domain Admin logons.

Open weakness

3. j.okonkwo
Member of Domain Admins.
4. Domain Admin
A second, independent way in. Retiring svc-backup does not close this.

Found on PT-1828.

Loading the path…

Domain Admin

Fix that breaks this chain

Proof on each hop

1. Password audit

2. Credential stuffing

3. j.okonkwo

4. Domain Admin

Domain Admin

Fix that breaks this chain

Proof on each hop

1. Password audit

2. Credential stuffing

3. j.okonkwo

4. Domain Admin