Everyone, and I mean every last Fu..... one of you, go out and buy the commercial version of Adalanche to assess your Active Directory security posture Today!

https://www.netsection.com/editions/

It is really awesome, and who doesn't want to "Effortlessly map out attack paths and do risk based remediation"

#Adalanche #ActiveDirectory #Microsoft #Security #Cyber #Threat #Microsoft #Risk #DoItNow

ChatGPT knows about my tool Adalanche. Not all is true (it does not bruteforce anything), but most is. Fun! #adalanche #chatgpt

It's done: Foreign-Security-Principal nodes are GONE from Adalanche, except for the built in WellKnownSID groups, which I have to take a look at how to handle next.

I think the results are much better, and when I get the new query engine done it will make more sense when defining searches.

If you have a multi domain / forest setup, I'd love some feedback.

Please note: there are some warnings being output right now, if you're playing with the latest builds, but everything looks fairly sane here to me.

#Adalanche -> https://github.com/lkarlslund/Adalanche

GitHub - lkarlslund/Adalanche: Active Directory ACL Visualizer and Explorer - who's really Domain Admin? (Commerical versions available from NetSection)

Active Directory ACL Visualizer and Explorer - who's really Domain Admin? (Commerical versions available from NetSection) - lkarlslund/Adalanche

GitHub

Adalanche: Improved Domain Controller auto-detection and selection in Adalanche.

You can now supply a list of servers on the command line, or Adalanche will detect them from DNS itself. Then it tries to connect to each of them in turn, until it finds a usable one.

It doesn't honor the Sites & Services lookup yet, but this should work fine until then.

It should probably handle different errors differently, i.e. login errors should just error out instantly. Feedback is welcome!

#adalanche -> https://github.com/lkarlslund/Adalanche

GitHub - lkarlslund/Adalanche: Active Directory ACL Visualizer and Explorer - who's really Domain Admin? (Commerical versions available from NetSection)

Active Directory ACL Visualizer and Explorer - who's really Domain Admin? (Commerical versions available from NetSection) - lkarlslund/Adalanche

GitHub
Oooooh, so close #Adalanche
Here's a preview of the results of my experiment with loading data from the Sentinel "DeviceLogonEvents" into Adalanche. Instant success - here's an AD account that promiscuously logs in to *every* machine it finds once in a while. It's a member of Domain Admins, and not a member of Protected Users. What could possibly go wrong? If you're using SCCM push accounts incorrectly, this can look the same. Customer confirmed, and fixed it right away. Adalanche FTW! #activedirectory #adalanche
GitHub - lkarlslund/Adalanche: Active Directory ACL Visualizer and Explorer - who's really Domain Admin? (Commerical versions available from NetSection)

Active Directory ACL Visualizer and Explorer - who's really Domain Admin? (Commerical versions available from NetSection) - lkarlslund/Adalanche

GitHub