Active Directory (AD) is a critical component of many organizations’ IT infrastructure, as it manages the identities and access rights of users and devices. However, AD security is notoriously complex and challenging, as it involves a large number of permissions, delegations, and configurations that can be easily misused or exploited by attackers. To help you visualize and explore the potential risks and vulnerabilities in your AD, a new open-source tool called Adalanche has been released.
Adalanche is an AD ACL (Access Control List) visualizer and explorer, created by Lars Karlslund, a security researcher and consultant. Adalanche can collect information from AD or local Windows machines, and then analyze and display the data in a graphical interface. Adalanche can show you what permissions users and groups have in your AD, and who can take over accounts, machines, or the entire domain. Adalanche can also help you find and show misconfigurations that could compromise your AD security.
Adalanche is designed to be easy to use and fast to get results. You don’t need to install anything, as Adalanche is an all-in-one binary that runs on Windows, MacOS, and Linux. You don’t need any special privileges, as Adalanche can work with a regular non-admin user account. You don’t need to wait for hours, as Adalanche can give you insights within minutes.
How does Adalanche work and what does it show?
Adalanche works by querying the AD or local machines for various attributes and permissions, such as user accounts, groups, organizational units, group policy objects, domain controllers, services, files, and registry keys. Adalanche then builds a graph of the collected data, where each node represents an entity and each edge represents a permission or a relationship. Adalanche then applies various algorithms and heuristics to identify and highlight the most interesting and dangerous paths in the graph.
Adalanche shows you the graph in your web browser, where you can interact with it and explore it in different ways. You can search for specific nodes or edges, filter by attributes or permissions, zoom in and out, and export the graph as an image or a CSV file. Adalanche also provides a summary of the most important findings, such as who can take over the domain, who can access sensitive data, who can escalate privileges, and who can bypass security controls.
Why should you use Adalanche and what are the benefits?
Adalanche is a useful tool for anyone who wants to improve their AD security and prevent potential breaches. Adalanche can help you:
- Audit your AD permissions and delegations and make sure they follow the principle of least privilege and best practices.
- Detect and fix any misconfigurations or vulnerabilities that could expose your AD to attacks or abuse.
- Identify and monitor any high-risk or high-value users and assets and apply appropriate security measures and controls.
- Investigate and respond to any suspicious or malicious activities and trace the source and impact of any incidents.
- Educate and train yourself and your team on AD security and the common attack vectors and techniques.
Adalanche is not only a tool for security professionals, but also for IT administrators, auditors, consultants, and researchers. Adalanche can help you understand and manage your AD better, and provide you with valuable insights and recommendations.
How can you get Adalanche and what are the next steps?
Adalanche is an open-source project, and you can download it from its GitHub repository
If you want to try Adalanche on a test environment, you can use the sample data from the Orange Cyberdefense lab Game of Active Directory project2, which is a vulnerable AD lab comprising five Windows machines and two Windows servers.
If you want to use Adalanche on your own AD, you can start by running the binary on your preferred platform and connecting to your AD. You can then deploy the dedicated collector .exe for your Windows member machines via a GPO or other orchestration and get even more data. You can then analyze and explore the graph and see what Adalanche can reveal to you.
Adalanche is a powerful and effective tool for AD security, and you should use it to secure your AD and protect your organization.
