Skip to content

Do you already know what Active Directory is and how to use it with Pandora FMS?

What is Active Directory and how to use it with Pandora FMS?

As you may already know, in this blog, we’re so into answering the big questions. After answering in previous episodes what the meaning of our existence is or explaining everything you need to know about Office 365 Monitoring, in today’s episode we are going to discuss what Active Directory is. I hope you are very comfortable sitting in your respective gamer chairs or in your two-seater sofas, because here we go!

What is Active Directory?

Active Directory is a tool that provides directory services, which entails many benefits in the business sector. Many companies have a large number of employees, they need a connected device to do their work, and there we have Active Directory, with it we can build a network of devices for users or employees.

How to collect information on user and service monitoring with Active Directory?

We already know that obtaining information is a very important section of monitoring. All these data can be very useful for us to see the status of something, find a possible problem or simply improve a certain system. Active Discovery is a process by which information can be collected while managing everything in a very simple way. We will be able to see what we need from a single computer, which will make the task much easier, since we will not have to act on each of the devices. In this article, we are going to give you the guidelines to configure Active Discovery and be able to use it.

What are the benefits of using Active Directory?

  • It is focused on professional and business use. It allows you to manage everything easily and without having to intervene in the computers of each user, which saves a lot of time.
  • Store data in real time. With data related to users and their authentication.
  • User authentication. If everything’s ok, the user’s information will reach the computer. This means that if one computer breaks down, you will be able to access it from another with authentication.
  • Easily manage all servers and applications, ensuring that everything runs at peak performance.
  • Prevention of replication errors. To verify that all replications are being performed optimally. Active Directory monitoring is essential, since you will obtain accurate information from them.
  • Obtaining information from remote sites and much more…

And here Pandora FMS comes into play

It is our standard: One of the principles of Pandora FMS is its flexibility. It is highly configurable and by using plugins you will be able to do almost anything in terms of monitoring. Making use of Active Directory in Pandora FMS is quite simple. You can use a specific plugin with which to collect different types of data. Like, for example, the number of users connected or inactive to be able to see them from the console. The data you may obtain is easily configurable from a simple txt, which will be the configuration file. The plugin can be found at the following link: https://pandorafms.com/library/active-directory/ Once downloaded, install it on the console. This short and simple process that will offer you great advantages will be explained below.

What is needed for the plugin to work?

  1. Powershell v3.0 or higher.
  2. Active Directory Powershell Module.
  3. Repadmin. The plugin needs a configuration file that will be divided into the following blocks and will be called “adparams.txt” :
  4. In user, you can choose whether to see the full list of all users or one in particular. In unused, a list of users that have not been used for at least two months. 1 to enable it and 0 to disable it.
  5. Spn allows you to see spn suffixes. 1 to enable and 0 to disable, as in the previous point.
  6. Upn allows you to see spn suffixes. 1 to enable and 0 to disable.
  7. You may also add the test block, which retrieves the information from the AD diagnostic tests that the dcdiag tool returns. 1 to enable and 0 to disable. Example: #tests Tests = 0
  8. We can run the plugin manually, calling executable.exe, writing the following output through the powershell terminal: [path_plugin]\active_directory.exe [path_conf]\adparams.txt
  9. It is recommended to save the file in pandora_agent/util.
  10. In the remote configuration of the agent that we have installed, add the following:
  11. When the interval goes by, modules collected by the users of Active Discovery, the connectivity, the status of the service or the suffixes spn and upn will be obtained.

Execution from the web console

To be able to run it from the console, the plugin will be distributed through collections. In configuration -> collections, create a collection, it will be named “Active Directory plugin” and short name “Ad_plugin”, in the following image you can see the process.

Go to files after creating the collection :

Click on “Upload Files”:

And upload the executable of the plugin and the configuration file that we created previously, then return to the previous menu and click “Create a file again” and later “Update”. In the agent where you want to use the plugin, go to the collections section and add it:

Next, go to “Agent plugins” and add the route with the plugin execution. In this case, as it is by means of collections, they will be created in the software agent installation path.

The path by default would be the view in the image (2).

Modules generated by the plugin

These will be the modules returned by a standard run.

Monitoring:

  • AD Users
  • Unused AD User
  • AD Schema Master
  • AD Root Domain
  • AD Forest Domains
  • AD Computer DNS Host Name
  • AD Global Catalogs
  • AD SPN suffixes
  • AD UPN suffixes
  • Connectivity
  • Replication admin
  • Service DNS status
  • Service DFS Replication status
  • Service Kerberos Key Distribution Center status
  • Service Active Directory Domain Services status
  • Test Advertising status
  • Test FrsEvent status
  • Test SysVolCheck status
  • Test KccEvent status
  • Test KnowsOfRoleHolders status
  • Test MachineAccount status
  • Test NCSecDesc status
  • Test Netlogons status
  • Test ObjectsReplicated status
  • Test Replication status
  • Test RidManager status
  • Test Services status
  • Test SystemLog status
  • Test VerifyReferences status

Service NetLogon status

  • Service Intersite Messaging status

And this is how they would look like in the created agent:

And, up to here that would be everything required to be able to make the plugin work. It was easy, huh? I hope many things in this life, but above all I hope this article was useful, especially to help you understand better Active Directory and how to use it in such a simple way in Pandora FMS. I will not take anymore of your time, indeed, I say goodbye, not before, of course, encouraging you to read other articles on the blog that may be to your liking and taste.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

ESET Threat Report T1 2021 highlights rapid abuse of trending vulnerabilities and configuration flaws by cybercrooks

BRATISLAVA – ESET, a global leader in cybersecurity, has released its T1 2021 Threat Report, summarizing key statistics from ESET detection systems and highlighting notable examples of ESET’s cybersecurity research, including exclusive, previously unpublished updates on current threats. The featured story recounts ESET Research’s discovery of multiple advanced persistent threat (APT) groups exploiting a vulnerability chain affecting Microsoft Exchange Server. The exclusive updates include new findings about the Lazarus and Turla APT groups and an analysis of a malicious iOS tweak that steals files from jailbroken iOS devices.

Starting with this issue of the ESET Threat Report, ESET Research aims to have a triannual publication, meaning that each report will cover a four-month period. For easier orientation, the T1 abbreviation will be used to describe the period from January to April, T2 from May to August, and T3 from September to December.

During the first four months of this year, the COVID-19 pandemic was still the number one news topic globally; however, it became notably less prominent in the threat landscape. “One could say ‘fortunately,’ yet as you’ll see in our report, we are continuing to see worrying examples of cybercrooks rapidly abusing trending vulnerabilities and configuration flaws with a focus on achieving high returns on investment,” comments Roman Kováč, Chief Research Officer at ESET. These abuses include continued abuse of the remote desktop protocol (RDP), which remains the number one target of brute-force attacks, increased numbers of cryptocurrency threats, and a steep increase of Android banking malware detections.

The featured story of the report recounts ESET Research’s analysis of a vulnerability chain that allows an attacker to take over any reachable Exchange server. The attack has become a global crisis and ESET researchers identified more than 10 different threat actors or groups that likely leveraged this vulnerability chain.  

The exclusive research presented in the T1 2021 Threat Report brings several updates and new findings about the APT groups Turla and Lazarus. It also includes information about a malicious iOS tweak, which is an application that leverages runtime patching in order to change program behavior, to execute shell commands on jailbroken and compromised iOS devices.

The ESET T1 2021 Threat Report also reviews the most important findings and achievements by ESET researchers. Among many other findings, including an ongoing series investigating Latin American banking trojans, ESET researchers uncovered the Kobalos malware, which attacks high performance computer clusters and other high-profile targets; Operation Spalax, which targets Colombian government organizations and private entities; a highly targeted supply‑chain attack that focused on online gaming in Asia; and a new Lazarus backdoor that was used to attack a freight logistics company in South Africa.

Besides these findings, the report also recapitulates the many virtual talks held by ESET research specialists in T1, introduces talks planned for the upcoming months, and provides an overview of ESET’s participation in the MITRE ATT&CK® Evaluations that emulated the Carbanak and FIN7 adversary groups.

For more information, check out our ESET Threat Report T1 2021 on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Visual communication tools hand in hand when supporting special education

LetaAnn Miller is a special education teacher in the largest school district in the state of Georgia. Prior to teaching, LetaAnn spent eight years working with individuals with autism and other developmental differences in schools, homes, virtual, and community settings. Having such an opportunity afforded LetaAnn the ability to develop various perspectives of learning, teaching, and supporting students prior to the pandemic and strengthened the desire to find solutions to teaching digitally.

Despite being faced with multiple challenges during the pandemic, both the V4K and iDocCam software have allowed LetaAnn to transition to online teaching with ease while still retaining the engaging element of her teaching.


“When teachers were introduced to IPEVO, it allowed teachers to manipulate the camera’s view, split screens between instructional material, teacher view, and more. Also, it allowed teachers more flexibility in movement while teaching. For instance, once I had the IPEVO software, I could bend my document camera to where it was standing up so my students could see me standing and teaching and not sitting behind a screen without using multiple devices and trying to juggle platforms. Also, it allowed me to manage students and behavior more effectively and provide students with more reinforcement while teaching. Such a simple “tech hack” with the addition of software and materials already provided in the classroom allowed for better teaching without an added financial burden on individuals.”

Before integrating IPEVO products into her teaching, LetaAnn explains:


“Despite having many plans to boost student engagement and learning during digital instruction, doing such a task initially involved multiple components of technology and many pieces of equipment. Expanding the steps to provide quality instruction also expanded the room for error and for technological blips. Witnessing struggles in classrooms I supported and within my own lessons, I easily recognized the need for a more streamlined process of technology.”

LetaAnn saw both efficiency and engagement rise considerably, resulting in a much better experience all around. She explains:


“With the addition of the IPEVO products, I was able to eliminate multiple steps of meeting with students online, providing instruction and sharing materials. This afforded opportunities for varied instruction and building stronger connections with all students.”

As an passionate and dedicated educator, LetaAnn was successful in utilizing IPEVO products for not only herself but also for the whole county. She summarizes:


“When considering life over the past year, returning to big pictures, struggles, and deficits is easy. Conversely, when moments of success or improvements are broken apart and considered for every piece, the magnitude of its impact is amplified. I am beyond grateful for the addition of IPEVO to our county, school, and classroom. Not only did their customer service team go above and beyond to troubleshoot issues and develop a meaningful connection when interactions with others are vastly different, they provided educators, students, and families with meaningful change and lasting impact.“

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About IPEVO
IPEVO makes versatile teaching tools instead of specialized “classroom equipment”.
We go beyond the usual conventions of classroom technology—large, expensive, specialized and complex—to rethink simple and flexible solutions for interactive teaching in today’s classrooms.
IPEVO’s interactive teaching tools empower educators and teachers with radically affordable and compact technology that is simple, intuitive and flexible, so that precious time and resources can be wholly dedicated to teaching. We intend to make educational technology accessible and available to all.

解構Target Ransom & Malware Steal的技術手法

這幾年Ransomware的新聞頻傳，雖然各個企業也因此提出相當多的對策與防範機制，但Ransomware還是日益猖獗且不斷的進化。Ransomware從一開始的加密受害者的資料，進而勒索贖金；到竊取受害者的資料，再對受害者勒索贖金否則就公開資料進而威脅受害者；到現在Ransomware不只是加資料加密還另外將資料竊取走，再對受害者進行贖金的勒索。不管中那一種勒索病毒，都會讓受害者損失慘重。

Targeted Ransomware這兩年開始出現，更是讓企業氣得牙癢癢的Ransomware攻擊模式，Targeted Ransomware是高度客製化的Ransomware，專門針對被鎖定的企業，對該企業製造客製化的Ransomware，進行嗅探偵測找出脆弱點，潛伏在企業的系統中伺機透過漏洞進行攻擊，進而勒索該企業，若不付贖金就會公布機密資訊的方式，讓各個大企業乖乖就範。

 

大企業都對勒索病毒做了防護?

既然各大企業都對勒索病毒做了防護，那勒索病毒到底是如何進入企業的環境呢?到底是如何突破企業的防護，難道是防毒與防Spam的機制出了問題嗎?我們統計近幾年上百隻的Ransomware，做了分群歸類，研究勒索病毒的攻擊方式與行為，大致分為

  • Targeted Ransomware DLL Injector
  • 無檔案式攻擊(Fileless)
  • APT攻擊方式
  • 宰殺防毒與備份檔案
  • 利用系統白名單進行惡意行為

這些攻擊模式往往無法只靠單純的防毒與Anti-Spam是無法防範的。且除了上述的攻擊方式外，人員往往是在資訊安全最重要的一環，駭客也最常使用社交工程的方式，透過Mail夾帶惡意連結或是檔案，讓防毒與Anti-Spam偵測不出來進行攻擊，再配合上述的攻擊方式，輕易的製造企業內的後門漏洞，進而讓勒索病毒可以大肆的入侵。

 

Mail社交工程來看，駭客往往會寄發釣魚信件

我們就從Mail社交工程來看，駭客往往會寄發釣魚信件來到各大企業的信箱，而這些Mail往往都會夾帶附件或是在內文中嵌入惡意連結，而這些附件已經不是壓縮檔或是執行檔了，因為這些檔案都會被Spam輕易的擋下來，而Mail附件就會以Office的檔案為主，而這些Office檔案看似無害，但只要企業點擊打開，那就會讓駭客可以直接植入後門、病毒…等。而這些駭客到底如何植入這些惡意連結呢?其實很簡單，是利用了Office Macro的功能，Office Macro可以寫入VBA的程式，VBA程式可以呼叫PowerShell或CMD來進行許多的攻擊。最常見的手法是VBA程式中，呼叫PowerShell或CMD，在PowerShell或CMD的指令中進行指令混淆，混淆的Code就是從網路上下載具有惡意攻擊的PS1腳本，而這些腳本內容當然也進行了多層的混淆，這些腳本透過PowerShell的指令直接進入電腦中的記憶體執行，過程中不殘留任何的檔案，這種攻擊方式就是「無檔案式攻擊」。

而腳本的攻擊內容大致分為3大類，第一直接宰殺該電腦的防護機制(防毒)，第二刪除該電腦中所有的備份，第三下載Ransomware病毒直接進行加密與竊取。這些腳本是利用Windows的程式(一般稱為白名單)，例如:vssadmin.exe、wmic.exe、bcdedit.exe、taskkill.exe等等，用這些Windows程式做攻擊方式，甚至更高深的Ransomware會使用到DLL Injector技術，直接注入到這些程式中，最知名的例子就是Netwalker Ransomware，這支病毒是直接DLL Injector到Explorer.exe中，透過Explorer進行竊取加密，由於Explorer.exe是一般企業不能也不會阻擋的應用程式，剛好駭客就利用這點直接DLL Injector到Explorer.exe。

 

在面對多樣化的勒索病毒威脅要如何防護呢?

現今從勒索病毒的攻擊方式著手，勒索病毒進入公司內部系統後所產生的行為，如同上述的Targeted Ransomware DLL Injector、無檔案式攻擊(Fileless)、APT攻擊方式、宰殺防毒與備份檔案、利用系統白名單進行惡意行為…等。要阻擋這些惡意的攻擊方式，可以使用X-FORT的應用程式控管機制，只有了解Ransomware攻擊與發作的模式，從中進行阻斷，才有辦法阻擋惡意程式，就算Ransomware進入到電腦中，也會因為X-FORT的應用程式控管機制，讓Ransomware無法發作攻擊，以大幅達到預防的效果，甚至搭配FAC(資料夾防護)與安全備份的功能，資料能完全保護住，讓企業達到預防、止災的效果。

關於Version 2

Version 2 Digital 是立足亞洲的增值代理商及IT開發者。公司在網絡安全、雲端、數據保護、終端設備、基礎設施、系統監控、存儲、網絡管理、商業生產力和通信產品等各個領域代理發展各種 IT 產品。透過公司龐大的網絡、通路、銷售點、分銷商及合作夥伴，Version 2 提供廣被市場讚賞的產品及服務。Version 2 的銷售網絡包括台灣、香港、澳門、中國大陸、新加坡、馬來西亞等各亞太地區，客戶來自各行各業，包括全球 1000 大跨國企業、上市公司、公用事業、醫療、金融、教育機構、政府部門、無數成功的中小企及來自亞洲各城市的消費市場客戶。

關於精品科技
精品科技(FineArt Technology) 成立於1989年，由交大實驗室中，一群志同道合的學長學弟所組合而成的團隊，為一家專業的軟體研發公司。從國內第一套中文桌上排版系統開始，到投入手寫辨識領域，憑藉著程式最小、速度最快、辨識最準等優異特性，獲得許多國際大廠的合作與肯定。歷經二十個寒暑，精品科技所推出的產品，無不廣受客戶好評。

How Does Privileged Access Management Prevent Cyberattacks?

In the digital age we are in, it is essential to protect all the data we have, whether it is our own data or from the users who provided it. No user without permission should have a chance to access sensitive information.

According to Trend Micro’s annual cybersecurity report – A Constant State of Flux -, in 2020, more than 1453 vulnerabilities were identified – that’s just the number of warnings published ⎼, 173 of which consisting of critical severity and 983 of high severity.

Vulnerabilities like these are an open door for cyberattacks to happen. But let’s better understand what they are and how privileged access management prevents cyberattacks.

What are cyberattacks?

Cyberattacks are basically attacks by hackers on a specific computer, system, or computer network.

The goals of an attack like this can vary widely: they range from stealing user data, making modifications to systems, or even bringing down an entire network.

This type of crime can be associated with the category of extortion, considering that it is quite common for hackers to charge an amount of money for the attack to stop, so that important information is not leaked or any other aspect that may be extremely important for the victim.

Perhaps it may seem like something that does not happen very often, given the apparent difficulty of invasion, but Brazil alone has suffered more than 8.4 billion cyberattack attempts in 2020. This shows us that it is essential to always be aware of our system’s flaws and gives us an idea of the size of the risk we are facing.

How do hackers manage to break into systems?

There are several ways to break into a system, and with each passing day, criminals invent new ways to do this. Among them, we can mention:

Ransomware

The term ransomware is a fusion of the terms ransom, which is exactly what it means, and malware, a term referring to malicious software.

It is basically malware that blocks a series of files or an entire system, from which a ransom is charged for their release. It is literally a virtual kidnapping.

Ransomware can gain access to the system in different ways: via email links, social media links, websites, or by installing apps. Once inside, the virus encrypts the data, preventing the user from gaining access.

Generally, the ransom is charged in cryptocurrencies such as bitcoin. This is due to the virtually zero chance of tracking it, making it almost impossible to identify the criminal.

Spyware

This is used as spy malware. It is quite difficult to detect as it works in the background.

It is widely used for stealing confidential information such as passwords, banking, credit card, or any other information that is useful for criminals.

They usually have access by downloading free files or programs from the Internet.

Keylogger

Malware like this has the function of recording everything that is being typed on a keyboard. It is a type of spyware, that is, they are occasionally used in so-called phishing attacks, those designed for identity theft.

A Keylogger can also be hardware, such as a USB cable or a flash drive.

DDoS Attack

Also known as distributed network attacks or distributed denial-of-service attacks. DDoS attacks work by making a large number of requests to an online service to exceed the system’s capacity, preventing it from functioning properly.

They usually do this intending to request an amount to stop the attack. For this to happen, the hacker uses a series of infected computers; the network that these computers are part of is called a zombie network.

What characterizes privileged access?

As its name suggests, users who have this type of access have privileged accounts to access sensitive administrative information. They can change passwords, view user data, modify settings, and perform other related actions.

In general, users like this have accounts with very complex passwords and, in many cases, these accounts are shared among several administrators. But that alone is not enough. It is necessary to closely monitor each credential, especially those that are common among several people.

How does privileged access management prevent cyberattacks?

Privileged Access Management (PAM) is here precisely to help organizations to implement control of privileged actions efficiently.

Users who have this type of access are constantly accessing critical organization resources. Monitoring who joins the system, when that person logs in, and also if they are performing the activities assigned to them is of utmost importance.

A PAM solution is used for this very purpose. Thus, one can guarantee the user is really the one with the authorization, not a hacker who got someone’s credential information.

The solution does this by forcing the person to request a just-in-time authorization, limiting the space they have to work with and also setting a sufficient time limit to perform the required task.

This way, there is no unnecessary exposure of information, ensuring greater security and exponentially reducing the loopholes for hackers to work.

A PAM system can go further and block the user if they are performing unauthorized tasks, which is great for reducing the chances of falling victim to a cyberattack.

It is important to mention that no solution is 100% effective, but the more barriers there are between people and data, the lower the risks.

As we have seen, hackers have a variety of ways to perform their activities. When we talk about users with privileged access, we are dealing with a huge risk for the organization. A hacker can simply steal someone’s authorized credential and use it to break into the administrative system.

A PAM system is essential to put another virtual barrier, reducing the number of loopholes and considerably reducing the vulnerability of a system.

senhasegura is a PAM solution that allows and helps you to secure and protect your data. You can request a demo and learn more about the quality of the service provided. Do not waste time and do not be one more person in the victim statistics!

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.