Addressed feedback

* Added active_directory.sensitive_data_exposure
* Renamed active_directory.sscm_abuse.ntlm_site_server_site_systems
* Added active_directory

Author: RRudder

…ntlm_site_server_site_system/guidance.md …description/active_directory/guidance.mdsubmissions/description/active_directory/sscm_abuse/ntlm_site_server_site_system/guidance.md renamed to submissions/description/active_directory/guidance.md submissions/description/active_directory/sscm_abuse/ntlm_site_server_site_system/guidance.md renamed to submissions/description/active_directory/guidance.md

@@ -0,0 +1,3 @@
+# recommendation(s)
+
+The specific remediation depends on the specific finding but should follow Microsoft's Active Directory security best practices. In general, enforce strong password policies, deploy LAPS for local administrator password management, remove unnecessary privileged group memberships, and implement an automated account lifecycle process.

submissions/description/active_directory/recommendations.md

@@ -0,0 +1,5 @@
+# Guidance
+
+Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed up triage time and result in faster rewards. Please include specific details on where you identified the vulnerability, how you identified it, and what actions you were able to perform as a result.
+
+Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC).

submissions/description/active_directory/sensitive_data_exposure/guidance.md

@@ -0,0 +1,3 @@
+# recommendation(s)
+
+The specific remediation depends on the specific finding but should follow Microsoft's Active Directory security best practices. In general, enforce strong password policies, deploy LAPS for local administrator password management, remove unnecessary privileged group memberships, and implement an automated account lifecycle process.

submissions/description/active_directory/sensitive_data_exposure/recommendations.md

@@ -0,0 +1,17 @@
+Sensitive data was identified within the Active Directory environment and is accessible without authentication, or with permissions that are overly broad for authenticated domain users. The sensitive information is accessible due to open file share, the domain controller accepting LDAP queries without authentication, or due to other misconfigurations An attacker can take advantage of these misconfigurations to browse and download sensitive content, such as credentials, internal infrastructure diagrams, database backups, source code, financial records, or personally identifiable information.
+
+**Business Risk**
+
+Open file shares expose sensitive organizational data to any user or attacker with network or domain access. Credentials found in shared documents can be used for lateral movement and privilege escalation. This could result in indirect financial losses, damage to the organization's reputation, and erosion of customer trust, especially if sensitive customer information is compromised.
+
+**Steps to Reproduce**
+
+1. Authenticate to the domain as a low privileged user from {{attacker_host}}
+1. Enumerate the specific weakness in the domain
+1. Compare and the observed weakness against the security baseline at {{baseline_reference}}
+
+**Proof of Concept (PoC)**
+
+The screenshot(s) below demonstrate(s) the vulnerability:
+>
+> {{screenshot}}

submissions/description/active_directory/sensitive_data_exposure/template.md

@@ -0,0 +1,5 @@
+# Guidance
+
+Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed up triage time and result in faster rewards. Please include specific details on where you identified the vulnerability, how you identified it, and what actions you were able to perform as a result.
+
+Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC).

submissions/description/active_directory/sscm_abuse/ntlm_site_server_site_systems/guidance.md

@@ -0,0 +1,17 @@
+Active Directory (AD) weaknesses can stem from insecure settings in the domain environment that increase the attack surface for credential theft, privilege escalation, and domain compromise. Common weaknesses include weak password policies, excessive privileged group membership, and shared local administrator passwords, amongst others. These weaknesses reduce the effort needed for an attacker to compromise the domain.
+
+**Business Risk**
+
+This vulnerability may lead to an attacker compromising the affected user accounts. The extent of malicious impact is dependent on the permissions of the compromised user.
+
+**Steps to Reproduce**
+
+1. Authenticate to the domain as a low privileged user from {{attacker_host}}
+1. Enumerate the specific weakness in the domain
+1. Compare and the observed weakness against the security baseline at {{baseline_reference}}
+
+**Proof of Concept (PoC)**
+
+The screenshot(s) below demonstrate(s) the vulnerability:
+>
+> {{screenshot}}