Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000130

Privileged AD object with permissions allowing takeover by regular user

Critical
Active Directory
Credential Access Defense Evasion Persistence Privilege Escalation
v47

Signature Identity

CTD-000130
Threat ID
47
Version
IOA-IOC
Indicator Type

Threat Description

Active Directory objects such as users, computers, and groups are securable objects. A Discretionary Access Control List (DACL) is an internal list attached to an object in Active Directory that specifies which users and groups can access the object and what kinds of operations they can perform. It is implemented using access control lists. When a process tries to access a securable object, the system checks the ACEs in the object’s DACL to determine whether to grant access to it or not.

Threat actors may modify an object’s DACL to bypass defense mechanisms and establish a persistent presence within your environment. By exploiting weak or misconfigured permissions, a regular user could escalate privileges, allowing them to manipulate objects, disrupt operations, or access sensitive resources.

Cayosoft Guardian monitors changes to DACLs and triggers alerts when suspicious modifications are detected. The rule checks the following objects and permissions:

Objects:

  1. Domain controllers
  2. Domain root
  3. Domain controllers Organizational Unit (OU)
  4. Privileged accounts and groups
  5. Specific objects with critical permissions

Permissions:

  1. ForceChangePassword: Ability to reset another user’s password
  2. GenericAll: Full control over an object
  3. GenericWrite: Ability to update any attributes of an object
  4. WriteOwner: Capability to assume ownership of an object
  5. AllExtendedRights: Rights to add users to groups or reset passwords
  6. WriteDacl: Ability to modify an object’s DACL
  7. Self (Self-Membership): Ability to add oneself to a group

NOTE: Cayosoft Guardian considers both direct and indirect (nested) group permissions when evaluating risks. Privileged users are defined in Active Directory as users with adminCount=1. By design, Active Directory uses this attribute to protect members of administrative groups.

According to security best practices, it is not recommended to reuse admin accounts; instead, these accounts must be de-provisioned. If an account has administrative permissions, it may also gain access to other resources using these permissions and retain this access even after it is removed from the administrative groups. Learn more about AdminSdHolder and SDProp – Microsoft Community Hub.

MITRE ATT&CK: Attack Tactics

Credential Access Defense Evasion Persistence Privilege Escalation

D3FEND: Defend Tactics

Application Configuration Hardening

Remediation

To change permissions using Active Directory Users and Computers:
  1. Press View > Advanced features.
  2. Locate the object with abusable permissions.
  3. Right-click on it, and select Properties.
  4. Select the Security tab.
  5. Remove unwanted users or groups from the list.
  6. Click OK to save the permission settings.

Frequently Asked Questions

What does Privileged AD object with permissions allowing takeover by regular user mean?

Privileged AD objects are granted excessive permissions, enabling regular users to modify their settings through misconfigured DACLs. This allows non-administrative users to manipulate objects and access sensitive resources.

This vulnerability enables attackers to escalate privileges, bypass defense mechanisms, and establish a persistent presence within the environment. It exposes sensitive data and disrupts operational continuity.

Attackers exploit misconfigured permissions on privileged objects, such as domain controllers or organizational units, to take control of the object, modify its settings, or access sensitive resources. This is achieved through weak or improperly configured DACLs.

Cayosoft Guardian continuously monitors Active Directory DACLs for suspicious modifications, including misconfigured permissions on privileged objects. It triggers alerts when detecting such changes to ensure prompt remediation and provide visibility into the attack path.

Cayosoft Guardian provides real-time monitoring and alerts administrators to misconfigured permissions, enabling teams to quickly identify and remediate vulnerabilities. This helps prevent attackers from exploiting them and supports investigation and response efforts.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory
Themes
Account protection Privileged Access Management
Attack Tactics
Credential Access Defense Evasion Persistence Privilege Escalation
Defend Tactics
Application Configuration Hardening
Indicator Types
IOA IOC
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical