Today, Immersive's Container 7 Research Team have released two new CTI labs covering the recent release of the vulnerability dubbed "BadSuccessor". You'll learn how to use this vulnerability against a vulnerable domain and how to threat hunt for signs of this attack occurring.
Two days ago, Akamai released a technical research blog post detailing a privilege escalation vulnerability in Windows Server 2025. This vulnerability abuses delegated Managed Service Accounts (dMSAs), and with the right base permissions, it could allow a user to gain domain admin permissions or even dump the NTLM hashes for all users in the domain. There is no patch available, and this would be considered a public zero-day.
Why are these labs important?
Many organisations use a Windows Domain to manage their users and accounts. This newly announced zero-day has no patch and no known detections in SIEMs. A combination of these labs will allow organisations to identify any potentially weak configurations vulnerable to exploitation and how to threat hunt in a SIEM to identify signs of exploitation.
Who is it for?
- Incident responders
- SOC analyst
- CTI Analysts
- Threat Hunters
- Pentesters / Red Teams
Here is the link to the analysis lab:
Immerser
Immerser
Immerser