Detection
Known vulnerabilities, insecure configurations, and Active Directory.
Inside the network, an attacker rarely needs a zero-day. The usual way in is an unpatched CVE, SMB without signing, or a service account with a weak password. BeforeTHEM looks for all three kinds of problem in the same scan.
Detection library
Thousands of detections, curated by offensive security experts.
The BeforeTHEM engine runs more than 8,800 detections, selected and maintained by our team. Checks that call for attack experience, such as those for Active Directory, configuration, and internal network services, are written by the CSURFACE offensive security team.
Beyond CVEs
Not every flaw gets a CVE.
A CVE is a public identifier assigned to a vulnerability in a specific product, in a specific version. It is issued when the vendor or a researcher reports the defect, and the fix is the responsibility of whoever built the software.
A large share of internal network risk has a different origin: how systems are configured and operated. A legacy protocol that is still enabled, a factory password that was never changed, or an overly broad permission on a system file are configuration decisions. That is why they get no CVE number and never appear in update bulletins.
For someone already inside the network, these flaws are often the shortest path. They need no exploit, apply to any version, and rarely trigger an alert. BeforeTHEM checks configuration and exposure with the same attention it gives to catalogued vulnerabilities.
Exposed protocols and services
SMBv1 still enabled, SMB without signing, which allows authentication relay, null sessions that list users and shares, and Java RMI and debug ports reachable over the network.
Factory passwords
Cameras, recorders, printers, and network devices that still use the username and password set by the manufacturer.
System configuration
RDP without Network Level Authentication, NTLMv1 accepted, LLMNR enabled, which makes credential capture easier, UAC turned off, unprotected LSASS, and a disabled firewall.
Permissions and access
Root login allowed over SSH, SUID binaries outside system packages, and cron, sudoers, and systemd files writable by any user.
Exposed panels and files
Administrative interfaces open on the internal network and configuration or backup files reachable without authentication.
Unsupported systems
Operating systems and applications that no longer receive updates. New flaws keep appearing, and the vendor no longer publishes fixes.
Active Directory
The path to domain admin runs through AD.
BeforeTHEM analyzes Active Directory in read-only mode and points out the accounts and settings an attacker could use to escalate privileges.
- Kerberoast and ASREPRoast. Accounts with an SPN and accounts without Kerberos pre-authentication.
- Unconstrained delegation. Machines and accounts that store the credentials of anyone who authenticates to them.
- Passwords. Accounts that don't require a password, passwords that never expire, and passwords written in the user description.
- Domain policy. Minimum length, complexity, and lockout after failed attempts.
MITRE ATT&CK
Every insecure configuration, linked to the technique it enables.
"SMB signing not required" means little to someone outside security. "Makes it easier to intercept and relay credentials (T1557)" makes clear what can happen. Whenever a matching ATT&CK technique exists, the configuration finding shows it.
See what BeforeTHEM finds on an internal network.
In the demo, you browse the findings from a simulated network with Active Directory, Windows and Linux servers, and OT equipment.