CyberArk DNA™ Demo Script

Overview
For organizations struggling to gain an accurate picture of the state of privileged account and
SSH Key management and compliance in their IT environment, CyberArk’s Discovery & Audit
(CyberArk DNA™) is a standalone, easy to use tool that exposes the magnitude of the
privileged account problem, often the root-cause of audit failures and advanced targeted
attacks.
DNA leads the way to easy management, auditing and automation of processes around
privileged accounts using CyberArk's market-leading privileged account protection,
accountability and intelligence solutions. DNA is the only tool on the market designed to identify
an organization’s Pass-the-Hash vulnerabilities using patent-pending technology. DNA helps
focus and pave the path toward mitigation using CyberArk’s solutions.

Using DNA Reports to Expose Security Threats

The CyberArk DNA report provides detailed information about the computers in an organization
and the accounts and account groups that have access to them. The scenarios described below
help you expose security threats, Pass-the-Hash vulnerabilities, and other important information
that can expose flaws in an organizational policy.

Account Scan

Scenario 1: How many non-compliant privileged accounts do I have?

Using the Executive Summary:
 In the Compliance Status section, the lowest pie chart shows the percentage of non-
compliant privileged and non-privileged accounts, as shown in the following screenshot:

© Cyber-Ark Software Ltd. | cyberark.com 1

Using the scan report:
1. Filter the Compliance Status column to show only Non-compliant records.
2. Filter the Account Category column to show only Privileged Shared/Local and Privileged
Personal/Domain records. This displays a list of all non-compliant privileged accounts.
3. Optional: Filter the Computer Type column to show only Server. This displays a list of all
non-compliant privileged accounts that can log into servers.
Non-compliant privileged accounts that can log into servers have a higher severity than those
that can only log into workstations.

Scenario 2: How many non-compliant Windows or Unix accounts do I have?

Using the Executive Summary:
 In the Compliance Status section, the two top pie charts on the right show the percentage
of non-compliant accounts for Windows and Unix, as shown in the following screenshots:

Using the scan report:

 In the Windows Scan and Unix Scan sheets, filter the Compliance Status column to show
only Non-compliant records.

Scenario 3: Which Unix account privileges have been escalated mistakenly?

 In the Unix Scan sheet, filter the Account Group column to show only *Sudoers file*
records.
This displays a list of all privileged accounts on Unix computers throughout the organization
that were given additional privileges via sudoers files.
 In the Unix Scan sheet, filter the Insecure Privilege Escalation column to show only
records that have values.
Of the privileged accounts that were given additional privileges, this displays a list of all the
accounts whose privilege might have been escalated accidentally.
See the Insecure Privilege Escalation: Reason column for the reason.
Sudoers files are difficult to maintain. Accounts found in sudoers files may have accidentally
been given the wrong privileges.

© CyberArk Software Ltd. | cyberark.com 2

Scenario 4: In the last quarter, were any local privileged accounts used to log into
servers?
1. Filter the Account Category column to show only Privileged Shared/Local records. These
are the local privileged accounts, such as Administrator.
2. Filter the Computer Type column to show only Server.
This displays a list of all local privileged accounts that can access servers. The Last Login Date
column shows the last date and time that the account was used to log into the correlated
computer.
This information shows when the account was last used to log into each computer.

Scenario 5: Do my servers have ‘backdoor’ accounts? How do I find all local

privileged non built-in accounts?
1. Filter the Account Category column to show only Privileged Shared/Local records. These
are the local privileged accounts, such as Administrator.
2. Filter the Computer Type column to show only Server.
3. In Account Description, clear Built-in account for administering the computer/domain.
This displays a list of all local non built-in privileged accounts that can access servers. The
accounts may have been:
 Left unintentionally by decommissioned applications. They may be leveraged maliciously as
‘backdoors’ to the advantage of attackers.
 Created by malware.
 Created by a third-party contractor without informing IT. Contractors may create such local
privileged accounts to aid in their work while not considering security implications.
Local privileged accounts are considered high risk due to their enhanced permissions.

Scenario 6: Which non-privileged accounts can access my servers?

1. Filter the Account Category to show only Non-privileged Shared/Local and Non-
privileged Personal/Domain records.
2. Filter the Computer Type column to show only Server.
This displays a list of all non-privileged accounts that can potentially log into the organization’s
servers.
It is bad practice to allow personal or shared non-privileged users to log into servers.

© CyberArk Software Ltd. | cyberark.com 3

Embedded and Hard-Coded Credentials Scan
This section describes a variety of typical scenarios that show how DNA can help you discover
embedded Windows credentials and hard-coded credentials that are exposed in your
organization.

Scenario 1: Which Windows credentials have been exposed by being embedded

throughout my organization? How many are non-compliant?
Using the Windows Scan sheet
 Filter the Account Category column to show only Service Account records. This will show
only accounts that have been embedded into different locations.
 To find out which are non-compliant, filter the Compliance Status column to show only
Non-compliant records
You can now analyze how these accounts can be leveraged maliciously. The Service Account
Type and Service Account Description columns help you understand in which locations (e.g.
Windows Services, Scheduled Tasks, IIS Application Pool, IIS Anonymous Authentication, etc.)
each account is used; most likely for actions such as backup, database connections, running
scheduled scripts, and so on.
It is best practice to be aware of Service Accounts used throughout your organization. Service
Accounts are likely to have privileged rights, and should therefore be compliant with
organizational policy.

Scenario 2: Where are embedded Windows credentials being used?

Using the Windows Scan sheet
 Filter the Account Category column to show only Service Account records.
This displays a list of your organization’s service accounts.
You can now analyze how these accounts may be leveraged maliciously. The Service Account
Type and Service Account Description columns help you understand how each account is
used; most likely for actions such as backup, database connections, running scheduled scripts,
and so on.
This information is essential to IT personnel in planning Privileged Identity Management.

© CyberArk Software Ltd. | cyberark.com 4

Scenario 3: Which credentials have been hard-coded into connectionStrings on
IIS servers and where?
Using the Hard-Coded Credentials sheet
DNA presents all instances of discovered connectionStrings on IIS servers.
 The Computer Name column displays the name of computer where the connectionString
was discovered.
 The Account Name column displays the extracted usernames from the discovered
connectionStrings.
 The Hard-Coded Credential column displays the connectionString that was discovered.
This information helps you understand which credentials were encoded, where they have been
found, in which files they’ve been hard-coded, and enables a bird’s eye view of the state of
hard-coded credentials on IIS servers.
CyberArk recommends eliminating any embedded or hard-coded credential to decrease the risk
of malicious exploitation.

SSH Keys Scan

This section describes a variety of typical scenarios that show how DNA can help you discover
SSH Key exposure in your organization. Some of these scenarios recommend that you refer to
the DNA Executive Summary that is described in detail in the CyberArk DNA User Guide.

Other scenarios recommend that you refer to the Pass-the-Hash Organizational Vulnerability
Map that is described in detail in the CyberArk DNA User Guide.

© CyberArk Software Ltd. | cyberark.com 5

Scenario 1: Which accounts enable access to machines via SSH keys?
Using the Unix Scan sheet
 Filter the # of Keys Found column to show only records with a value higher than 0. This will
show only accounts that have a Public SSH key associated to them.
This displays a list of accounts that users who have access to the correlating private SSH key
can use to establish an SSH connection to them and, thus, gain access to their privileges.

Scenario 2: How many non-compliant SSH Key Trusts do I have?

Using the Executive Summary:
 In the SSH Keys Compliance section, the pie chart shows the percentage of non-compliant
SSH Key Trusts, as shown in the following screenshot:

Non-compliant SSH Key Trusts are determined according to non-compliance of either the
private or public SSH key, or both. This number provides insight into the number of possible
SSH connections, from machine to machine, that may be used with non-compliant SSH keys.
Using the SSH Key Trusts sheet:
 Filter the Compliance Status column to show only Non-compliant (SSH Key) and Non-
compliant records.
This shows a list of all non-compliant SSH Key Trusts.

© CyberArk Software Ltd. | cyberark.com 6

Pass-the-Hash Vulnerability Scan
This section describes a variety of typical scenarios that show how DNA can help you expose
the Pass-the-Hash vulnerabilities in your organization. Some of these scenarios recommend
that you refer to the DNA Executive Summary that is described in detail in the CyberArk DNA
User Guide.

Other scenarios recommend that you refer to the Pass-the-Hash Organizational Vulnerability
Map that is described in detail in the CyberArk DNA User Guide.

© CyberArk Software Ltd. | cyberark.com 7

Scenario 1: How many Privileged account hashes were found and, as a result,
how many vulnerable machines are there?
Using the Executive Summary, in the “Credential Theft Vulnerability” section (as shown
in the screenshot above):
 In the Pass-the-Hash: Active Threats section, the number of the unique privileged account
hashes, and the total number of machines on which the hashes were found is displayed.
 On the right, in the Vulnerability Status section, the pie chart shows the percentage of
vulnerable machines in the entire organization, as a result of the Active Threats described
on the left.
The percentage of vulnerable machines easily points out the magnitude of the Pass-the-Hash
problem.
Using the Organizational Vulnerability Map:
 In the Executive Summary, in the Credential Theft Vulnerability section, click Open map.
In the dialogue box, choose which map file to open.
 On the right pane of the Organizational Vulnerability Map, the number of Machines causing
vulnerabilities, Vulnerable machines and Privileged account hashes found is specified.
Using the Windows Scan sheet:
 Filter the Pass-the-Hash: Vulnerable to show only records with Yes.
All the vulnerable Privileged accounts are displayed. Privileged accounts are vulnerable on a
certain machine because the Privileged account hash was found on another machine.
 Filter the Pass-the-Hash: Hash Found to show only records with Yes.
All the Privileged accounts whose hashes were found on a certain machine are displayed.

Scenario 2: Which machines cause a vulnerability on a certain machine? Which

machines are made vulnerable due to a certain machine?
Using the Organizational Vulnerability Map (as shown above):
 In the Executive Summary, in the Credential Theft Vulnerability section, click Open map.
In the dialogue box, choose which map file to open.
 Use the Search field to find a machine you would like to analyze or click any machine on the
map.
The map shows all machines that cause a vulnerability on this machine and/or all machines that
are made vulnerable due to this machine. See the legend at the bottom-left for more
information.

© CyberArk Software Ltd. | cyberark.com 8

Scenario 3: Which accounts cause vulnerabilities on the most machines?
Using the Organizational Vulnerability Map (as shown above):
 The size of a machine (node) represents how many vulnerabilities it causes. The bigger the
size, the more vulnerabilities it causes on machines in the organization.
Focusing on the larger machines first will make it easier to prioritize and mitigate Pass-the-Hash
threats more quickly.
Using the Windows Scan sheet:
1. Filter the Pass-the-Hash: Hash Found to show only records with Yes.
2. Sort Causes Vulnerability On # of Machines by largest to smallest.
This displays a list of all Privileged accounts whose hash has been found, sorted by the number
of machines that they cause a vulnerability on.
The first account on the list causes the most vulnerabilities in the organization, etc.

Scenario 4: What if Privileged Account Security were implemented in my

organization? How would that help me mitigate Pass-the-Hash?
Using the Executive Summary in the Credential Theft Vulnerability section (as shown
above):
 In the Pass-the-Hash: Mitigated with Privileged Account Security section, a “before and
after” simulation is given.
This shows the number of active privileged account hashes before implementing Privileged
Account Security and after implementing the use of one-time passwords for all privileged
accounts found by DNA.

Scenario 5: Which workstation may be a starting point for a Pass-the-Hash

attack?
Using the Windows Scan sheet:
1. Filter the Pass-the-Hash: Hash Found to show only records with Yes.
2. Filter the Computer Type to show only records with Workstation.
3. Filter the Account Type to show only domain records.
This displays a list of all workstations on which Privileged hashes have been found.
Oftentimes, workstations are the first step in a Pass-the-Hash attack since they are the most
susceptible to APTs.

© CyberArk Software Ltd. | cyberark.com 9

Scenario 6: Which Privileged account hashes were once stored, no longer pose a
threat, but constitute an imminent threat?
Using the Executive Summary in the Credential Theft Vulnerability section (as shown
above):
 In the Pass-the-Hash: Inactive Threats section, the number of unique privileged accounts
hashes, and the total number of machines on which privileged account hashes were
previously stored is displayed.
Hashes are deleted by Windows in certain scenarios, such as when logging off or restarting the
machine.
Using the Windows Scan sheet:
1. Filter the Pass-the-Hash: Hash Found to show only records with Previously.
2. Filter the Account Category to show only Privileged Shared, Privileged Personal, and
Service Account records.
3. Filter the Account Type to show only domain records.
This displays a list of all Privileged accounts whose hash has been previously stored on the
machine, but is no longer stored. Hashes are removed in certain scenarios, such as when
logging off or restarting the machine.
These privileged hashes may become a threat imminently, the next time they are used.

Scenario 7: Why are hashes being stored on my servers?

1. Filter the Pass-the-Hash: Hash Found to show only records with Yes.
2. Filter the Computer Type to show only records with Server.
3. Filter the Account Category to show only Privileged Shared, Privileged Personal, and
Service Account records.
4. Filter the Account Type to show only domain records.
This displays a list of all servers on which Privileged hashes have been found. The Threat
Cause column shows the reasons that hashes have been stored on the server.
For example: Remote command execution, Remote login via RDP.

Copyright © 1999-2015 by CyberArk Software Ltd. All rights reserved.

This document contains information and ideas, which are proprietary to CyberArk Software Ltd.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in
any form or by any means, electronic, mechanical, photocopying, recording, scanning, or
otherwise, without the prior written permission of CyberArk Software Ltd.

© CyberArk Software Ltd. | cyberark.com 10