{"id":3858,"date":"2019-10-25T10:31:31","date_gmt":"2019-10-25T17:31:31","guid":{"rendered":"https:\/\/zed.inguardians.com\/?p=3858"},"modified":"2020-05-06T14:29:11","modified_gmt":"2020-05-06T21:29:11","slug":"the-backup-operators-guide-to-the-galaxy","status":"publish","type":"post","link":"https:\/\/zed.inguardians.com\/presentations\/the-backup-operators-guide-to-the-galaxy\/","title":{"rendered":"The Backup Operators Guide to the Galaxy"},"content":{"rendered":"<p>Backup Operator accounts are ubiquitous and often overlooked by both blue and red teams. These accounts have abusable permissions and are rarely maintained properly. In this webinar, we will examine and demonstrate novel techniques to stealthily compromise Active Directory through the Backup Operator\u2019s account. We will use the Backup Operator account to gain local Admin privilege, establish persistence, and pivot laterally throughout a domain. However, all is not lost in that we can further lockdown our systems and enable auditing measures to deter and detect these attacks<\/p>\n<p>Presented by Dave Mayer, Head of the Red Team and Senior Security Consultant, InGuardians<\/p>\n<p><iframe loading=\"lazy\" title=\"The Backup Operators Guide To The Galaxy\" width=\"1080\" height=\"608\" src=\"https:\/\/www.youtube.com\/embed\/YaDBUfCQXW4?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe><\/p>\n<p><a href=\"http:\/\/zed.inguardians.com\/the-backup-operators-guide-to-the-galaxy\/backupoperators-1\/\" rel=\"attachment wp-att-3859\">Slides &#8211; The Backup Operators Guide to the Galaxy<\/a><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Backup Operator accounts are ubiquitous and often overlooked by both blue and red teams. These accounts have abusable permissions and are rarely maintained properly. In this webinar, we will examine and demonstrate novel techniques to stealthily compromise Active Directory through the Backup Operator\u2019s account. We will use the Backup Operator account to gain local Admin [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[67,51],"tags":[173,172,120,174,175,160,17,108,97,103,98],"_links":{"self":[{"href":"https:\/\/zed.inguardians.com\/wp-json\/wp\/v2\/posts\/3858"}],"collection":[{"href":"https:\/\/zed.inguardians.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zed.inguardians.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zed.inguardians.com\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/zed.inguardians.com\/wp-json\/wp\/v2\/comments?post=3858"}],"version-history":[{"count":2,"href":"https:\/\/zed.inguardians.com\/wp-json\/wp\/v2\/posts\/3858\/revisions"}],"predecessor-version":[{"id":3861,"href":"https:\/\/zed.inguardians.com\/wp-json\/wp\/v2\/posts\/3858\/revisions\/3861"}],"wp:attachment":[{"href":"https:\/\/zed.inguardians.com\/wp-json\/wp\/v2\/media?parent=3858"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zed.inguardians.com\/wp-json\/wp\/v2\/categories?post=3858"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zed.inguardians.com\/wp-json\/wp\/v2\/tags?post=3858"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}