zBang includes five different scans:

  1. ACLight scan - discovers the most privileged accounts that must be protected, including suspicious Shadow Admins.
  2. Skeleton Key scan - discovers Domain Controllers who might be infected by Skeleton Key malware.
  3. SID History scan - discovers hidden privileges in domain accounts with secondary SID (SID History attribute).
  4. RiskySPNs scan - discover risky configuration of SPNs that might lead to credential theft of Domain Admins.
  5. Mystique scan - discovers risky Kerberos delegation configuration in the network.

Quick start guide and more details are available at:

https://github.com/cyberark/zBang

The tool was developed by CyberArk Labs as a quick POC, and published for the security community.

zBang is a free risk assessment tool – it’s highly recommended to mitigate the discovered threats.