Protecting Privileged Domain Accounts during Live Response

Fixing Reflective Attack:
IR workstations need MS08-­‐068 applied
Fixing Relay Attack:
NTLMv2:
EPA embeds the Service Principal Name of the target service with
Extended Protection works because only domain controllers and
machines where the user directly enters the password can
compute/validate the Integrity Hash for the security blobs.
However, to be effective, ALL machines on the network must
enforce its use, which is no small task in most environments.
41