AD object with non-default primary group

This condition enables an attacker to silently inherit elevated permissions and hide their persistence in Active Directory by manipulating group membership and permissions. Specifically, an attacker can exploit this vulnerability to gain Domain Admin privileges without being detected.

Attackers can use the inherited elevated permissions to perform malicious activities such as lateral movement, privilege escalation, and data exfiltration. Additionally, they can hide their persistence in the domain by manipulating group membership and permissions.

Cayosoft Guardian continuously monitors Active Directory for changes to Primary Group IDs (PGIDs) on user or computer accounts, flagging non-default PGIDs as security issues so administrators can take action.

Cayosoft Guardian alerts administrators to disable or correct non-default PGIDs on affected accounts, preventing attackers from exploiting this vulnerability and limiting their ability to elevate privileges and persist in the domain. This helps provide visibility into potential attack paths and supports investigation and response efforts.