4 ms·
Apart from some special cases like Wannacry/NotPetya, ransomware crews do only as much lateral movement as is required for privilege escalation. Once they have
by aj3 6y ago
Apart from some special cases like Wannacry/NotPetya, ransomware crews do only as much lateral movement as is required for privilege escalation. Once they have DA, they can just disable protections and push malware centrally through AD.
- dredmorbius 6y agoDA / AD ???
- danielheath 6y agoDomain Admin (root permission in Active Directory).
- dredmorbius 6y agoThanks, suspected that.
- TwoBit 6y agoIt seems like a company's real challenge is preventing the escalation, more so than the initial compromise.