zBang includes five different scans:
- ACLight scan - discovers the most privileged accounts that must be protected, including suspicious Shadow Admins.
- Skeleton Key scan - discovers Domain Controllers who might be infected by Skeleton Key malware.
- SID History scan - discovers hidden privileges in domain accounts with secondary SID (SID History attribute).
- RiskySPNs scan - discover risky configuration of SPNs that might lead to credential theft of Domain Admins.
- Mystique scan - discovers risky Kerberos delegation configuration in the network.
Quick start guide and more details are available at:
https://github.com/cyberark/zBang
The tool was developed by CyberArk Labs as a quick POC, and published for the security community.
zBang is a free risk assessment tool – it’s highly recommended to mitigate the discovered threats.