Solved

Profile in assessment with executors having "Elevation required"

  • 9 November 2023
  • 3 replies
  • 43 views

Hello there,

 

I have template containing two executors, one has “Elevation required” set to True, the other to False.

 

When I create an assessment for such a template I am prompted to select a profile, I can select:

  1. NT AUTHORITY
  2. A logged in non administrator user

Which profile should I select? 

 

Thank you

icon

Best answer by renier_steyn 13 November 2023, 11:26

View original

3 replies

Userlevel 2
Badge

Hi @gabriele_paris 

I am not sure which module you are using, but I will assume it is Endpoint. Please correct me if not.

The elevation element speaks to local administrator rights.

All the assessments require a target host and profile to run. Out of the box, we have 2 profiles available, the system account and, if there is an active logged in session, the logged-in user. There are somethings to take into consideration around the logged-in user. 

  1. If there is no active user, the assessment will not run.
  2. If the user session expires during the course of an assessment, the assessment will fail at this point

It is possible to add more profiles to an agent. 

As different account types (System vs Standard User vs Service Account vs Priveledged User) could have different policies or restricitons applied, adding more profiles will allow you to have a much more extensive view on the risk associated for various roles within your environment.

If you would like to have a more in depth discussion about this or any other Cymulate related topic, please contact your Customer Success Manager or, for any technical issues, our super support team (support@cymulate.com).

Keep well!
Renier
Customer Success Team Lead (EMEA)

HI @renier_steyn,

 

Thank you for your quick reply.

The module I am using is the advance scenario via the purple_team API. In any case, your reply was satisfactory enough for me to understand what to do.

 

Kind regards,

 

Gabriele Paris

Userlevel 2
Badge

Super. Yes, same priciples apply.

Reply