Domain Admin

Proof on each hop

1. 1. VY-WIN-0142

   Assumed breach on the finance jump host.

2. 2. Outlook password

   a.chen's reused password.

   host: VY-WIN-0142
   file: Outlook offline store
   principal: a.chen
   password: [redacted]
   same secret accepted by ERP-SQL-01
   Defender alerted after the read. The logon was not blocked.

   Fix. Clear saved mail credentials and stop reusing the ERP password. This hop is not the path breaker.

   Open weakness

3. 3. a.chen

   Accepted by ERP-SQL-01.

4. 4. SQL sysadmin

   The application pool can read process memory.

   host: ERP-SQL-01
   login: NORTHLINE\svc-erp
   role: sysadmin
   a.chen's reused password reached this host
   No prevention. No detection.

   Fix. Drop sysadmin from the application pool and use a contained login.

   Open weakness

5. 5. svc-backup

   NTLM secret, redacted.

6. 6. Directory replication

   DC-01 accepted the request.

   source: ERP-SQL-01 process memory
   principal: svc-backup
   secret: NTLM [redacted]
   DC-01 accepted a replication request
   rights: Replicating Directory Changes All
   Sentinel: no alert in 15 minutes

   Fix. Retire svc-backup. Replication belongs on a monitored, short-lived identity.

   Open weakness

7. 7. Domain Admin

   Replication rights are enough to forge directory credentials.