Home > Attack Vectors > Unauthorized Modification

Unauthorized Modification

Unauthorized Modification in Active Directory

Unauthorized Modification in Active Directory refers to the various ways in which perpetrators attempt to enact legitimate technical operations on Active Directory contents so as to ultimately be able to gain access over a target object in Active Directory.

These attacks are extremely easy to carry out and they involve exploiting the presence of excessive/unauthorized access in Active Directory, which is usually caused by misconfigured delegated/provisioned access in the ACLs of Active Directory objects.



The following are the Top-15 most common unauthorized modification attack vectors used to compromise Active Directory contents -




  1. Reset the password of a domain user account

     •  Overview - A perpetrator attempts to reset the password of a domain user account, and if the operation is successful, he/she owns the account, and can immediately login as the victim and access everything the victim has access to.

     •  Minimum Requirement - In order to successfully reset a domain user account's password, the perpetrator only requires sufficient Extended Right - Reset Password Active Directory Effective Permissions on the target user account.

     •  Mitigation - Identify and lockdown who can reset the passwords of all domain user accounts in Active Directory.



  2. Change the permissions protecting a domain user account

     •  Overview - A perpetrator attempts to change the permissions protecting a domain user account, and if the operation is successful, he/she owns the account, as he/she can instantly grant oneself ability to reset its password and login as the victim.

     •  Minimum Requirement - In order to successfully change security permissions on a domain user account, the perpetrator only requires sufficient Modify Permissions Active Directory Effective Permissions on the target user account.

     •  Mitigation - Identify and lockdown who can change security permissions on all domain user accounts in Active Directory.



  3. Change the ownership of a domain user account

     •  Overview - A perpetrator attempts to change the ownership of a domain user account, making oneself its owner, and if the operation is successful, as owner, he/she can instantly grant oneself ability to reset its password and login as the victim.

     •  Minimum Requirement - In order to successfully change the ownership on a domain user account, the perpetrator only requires sufficient Modify Owner Active Directory Effective Permissions on the target user account.

     •  Mitigation - Identify and lockdown who can change the ownership of all domain user accounts in Active Directory.



  4. Reset the password of a domain computer account

     •  Overview - A perpetrator attempts to reset the password of a domain computer account, and if the operation is successful, he/she owns it, and can immediately login as the computer and access everything the account has access to.

     •  Minimum Requirement - In order to successfully reset a domain computer account's password, the perpetrator only requires sufficient Extended Right - Reset Password Active Directory Effective Permissions on the target computer account.

     •  Mitigation - Identify and lockdown who can reset the passwords of all domain computer accounts in Active Directory.



  5. Change the permissions protecting a domain computer account

     •  Overview - A perpetrator attempts to change the permissions protecting a domain computer account, and if the operation is successful, he/she owns it, as he/she can instantly grant oneself ability to reset its password and authenticate as it.

     •  Minimum Requirement - In order to successfully change security permissions on a domain computer account, the perpetrator only requires sufficient Modify Permissions Active Directory Effective Permissions on the target computer account.

     •  Mitigation - Identify and lockdown who can change security permissions on all domain computer accounts in Active Directory.



  6. Change the ownership of a domain computer account

     •  Overview - A perpetrator attempts to change the ownership of a domain computer account, making oneself the owner, and if the operation is successful, as owner, he/she can instantly grant oneself ability to reset its password and authenticate as it.

     •  Minimum Requirement - In order to successfully change the ownership on a domain computer account, the perpetrator only requires sufficient Modify Owner Active Directory Effective Permissions on the target computer account.

     •  Mitigation - Identify and lockdown who can change the ownership of all domain computer accounts in Active Directory.



  7. Change the membership of a domain security group

     •  Overview - A perpetrator attempts to change the membership of a domain security group, adding oneself to it, and if the operation is successful, as a member, he/she can instantly gain whatever (read & modify) access that group has, system-wide.

     •  Minimum Requirement - In order to successfully change the ownership on a domain security group, the perpetrator only requires sufficient Write Property - member Active Directory Effective Permissions on the target group.

     •  Mitigation - Identify and lockdown who can change the membership of all domain security groups in Active Directory.



  8. Add/remove oneself to a domain security group

     •  Overview - A perpetrator attempts to add one's own account to the membership of a domain security group, and if the operation is successful, as a member, he/she can instantly gain whatever (read & modify) access that group has, system-wide.

     •  Minimum Requirement - In order to successfully change the ownership on a domain security group, the perpetrator only requires sufficient Validated Write - Add/remove self as member Active Directory Effective Permissions on the target group.

     •  Mitigation - Identify and lockdown who can change the membership of all domain security groups in Active Directory.



  9. Change the permissions protecting a domain security group

     •  Overview - A perpetrator attempts to change the permissions protecting a domain security group, and if the operation is successful, he/she owns the group, as he/she can instantly grant oneself ability to change its membership and control it.

     •  Minimum Requirement - In order to successfully change security permissions on a domain security group, the perpetrator only requires sufficient Modify Permissions Active Directory Effective Permissions on the target group.

     •  Mitigation - Identify and lockdown who can change security permissions on all domain security groups in Active Directory.



  10. Change the ownership of a domain security group

     •  Overview - A perpetrator attempts to change the ownership of a domain security group, making oneself the owner, and if the operation is successful, as owner, he/she can instantly grant oneself ability to change its membership and control it.

     •  Minimum Requirement - In order to successfully change the ownership on a domain security group, the perpetrator only requires sufficient Modify Owner Active Directory Effective Permissions on the target group.

     •  Mitigation - Identify and lockdown who can change the ownership of all domain security groups in Active Directory.



  11. Change the permissions protecting an organizational unit (OU)

     •  Overview - A perpetrator attempts to change the permissions protecting an OU, and if the operation is successful, he/she owns the OU, as he/she can instantly grant any security principal, including oneself, any permission on the entire OU.

     •  Minimum Requirement - In order to successfully change security permissions on an OU, the perpetrator only requires sufficient Modify Permissions Active Directory Effective Permissions on the target OU.

     •  Mitigation - Identify and lockdown who can change security permissions on all organizational units in Active Directory.



  12. Change the ownership of an organizational unit (OU)

     •  Overview - A perpetrator attempts to change the ownership of an OU, making oneself the owner, and if the operation is successful, as owner, he/she can instantly grant any security principal, including oneself, any permission on the entire OU.

     •  Minimum Requirement - In order to successfully change the ownership of an OU, the perpetrator only requires sufficient Modify Owner Active Directory Effective Permissions on the target OU.

     •  Mitigation - Identify and lockdown who can change the ownership of all organizational units in Active Directory.



  13. Change the permissions protecting a container

     •  Overview - A perpetrator attempts to change the permissions protecting a container, and if the operation is successful, he/she owns it, as he/she can instantly grant any security principal, including oneself, any permission on the entire container.

     •  Minimum Requirement - In order to successfully change security permissions on a container, the perpetrator only requires sufficient Modify Permissions Active Directory Effective Permissions on the target container.

     •  Mitigation - Identify and lockdown who can change security permissions on all containers in Active Directory.



  14. Change the ownership of a container

     •  Overview - A perpetrator attempts to change the ownership of an container, making oneself the owner, and if the operation is successful, as owner, he/she can instantly grant any principal, including oneself, any permission on the entire container.

     •  Minimum Requirement - In order to successfully change the ownership of a container, the perpetrator only requires sufficient Modify Owner Active Directory Effective Permissions on the target container.

     •  Mitigation - Identify and lockdown who can change the ownership of all containers in Active Directory.



  15. Change the permissions protecting the domain root

     •  Overview - A perpetrator attempts to change the permissions protecting the domain root, and if the operation is successful, he/she owns the entire domain, as he/she can instantly grant any security principal, including oneself, any permission domain-wide, such as but not limited to compromising all accounts, computers and groups in the domain, as well as the ability to replicate secrets from the domain (via DCSync), which is tantamount to a complete domain compromise.

     •  Minimum Requirement - In order to successfully change security permissions on the domain root, the perpetrator only requires sufficient Modify Permissions Active Directory Effective Permissions on the target domain root.

     •  Mitigation - Identify and lockdown who can change security permissions on the domain root object in Active Directory.





Note - This is by no means an exhaustive list. There are numerous other attack vectors in this category that can be used to inflict damage. In the interest of organizational security worldwide, for now, this list shall be restricted to the above.