Autoattack

Test the access ransomware needs.

Name the objective: Domain Admin, the backup server, or access to critical data. AutoAttack pursues it across your network and records the access it gains. No encryptor is deployed.

What allowed access to the backup server?

In this hypothetical assessment, an employee account is the starting point. The objective is administrator access to backup-server.

Inspect the administrator access

The captured output supports administrator access on backup-server. Subscribers can inspect target names and captured evidence beside each gain.

Give the owner a specific exposure to review

Identify the readable file and the service account it exposed. The owner can check who needs access and which services depend on the credential before changing it. Remediation advice sits beside the relevant gain in a paid report.

  1. A readable file exposes a service credential.The employee account can read a configuration file containing the backup service account’s password.
  2. That credential provides administrator access.The campaign uses the recovered account to establish the requested privilege on backup-server.

The objective is administrator access to the named backup server. Plan backup restoration as a separate exercise.

How to read a report

Controls for the campaign

Set the objective, authorized scope, exclusions and starting access before deployment. Review the reversible changes included in the campaign setup.

Credential attempts use lockout controls. Each campaign runs in a fresh container, and you can request a stop from the campaign page.

How a foothold becomes broader access

An attacker can chain a foothold into broader access through stolen credentials, lateral movement and elevated privileges. The route depends on the environment.

One possible route through a Windows domain

  1. Initial access
  2. Escalation
  3. Lateral movement
  4. Domain control

    This is an example assessment objective.

  5. Mass encryption

    AutoAttack does not perform this step.

A reused password may open another host. Excessive permissions may expose a privileged account. In Active Directory, those steps can lead to Domain Admin, giving an attacker broad control of the domain. Ransomware does not require that privilege: access to a file share, backup system or individual server may already be enough to cause serious damage.

What the campaign can establish

Choose an objective that matters to your recovery plan, such as administrator access to a backup server. The report follows the access gained toward that target and states whether the objective was reached. Subscribers can inspect its evidence and remediation advice.

Use the result alongside recovery testing

Access testing can reveal routes you need to close. Use the campaign evidence alongside backup restoration and incident containment exercises. The ransomware readiness guide explains how to combine those exercises. Our published benchmark shows an example of a route to Domain Admin.

Test the route before an attacker does.

Start with a critical system and test the access available from your chosen network position.

Contact
Autoattack