38. Active Directory Attacks and Defence
38.7 Privilege Escalation Paths and Domain Admin Risks
Common AD privilege escalation (अधिकार वाढ) themes (concepts):
- ACL abuse:
GenericAll,WriteDacl,WriteOwneron users/groups/computers - Shadow admins / nested group surprises
- Unconstrained delegation on a computer – stolen TGTs risk if that host is compromised (prefer constrained / resource-based constrained delegation)
- Over-privileged service accounts that are also in high groups
- Legacy protocols + mis-set SPNs (38.4)
Domain Admin risk: backup operators, account operators, DNS admins (historically sensitive), replication rights (DCSync) – treat as Tier-0 adjacent. Remediation: clean nested groups; JIT/PAM; PAW; no standing DA for daily mail; audit privileged groups weekly.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Walks ACL edges until reset-password / group add on DA | Regular ACL / BloodHound reviews; remove WriteDacl/GenericAll sprawl |
| Targets unconstrained delegation hosts | Inventory TrustedForDelegation; migrate to constrained/RBCD; monitor |
| Adds self to privileged group after ACL abuse | Alert 4728/4732 on Domain Admins; webhook to SOC |
Ravindra Bagale's Tip
"Domain Admin daily driver" – sabse common Maharashtra SMB mistake (fictional shops pan). Raja Business Owner aso – daily Chrome DA session nako. Separate admin account + PAW habit. Interview madhe unconstrained vs constrained delegation one-liner tayar theva.
Lab
Lab DC var PowerShell (as lab admin): list users with SPN; list computers TrustedForDelegation. Document findings. Create intentional bad ACL on a test OU (GenericAll to amir) → BloodHound shows edge → remove ACL → re-verify. Never leave bad ACL overnight without snapshot restore plan.