Listen to this Post
Introduction:
A new breed of Active Directory persistence, known as Makhfi-SID, is demonstrating the ability to create truly invisible backdoors that evade all standard enumeration and monitoring tools. This technique allows attackers to maintain persistent access with Domain Admin and even Domain Controller privileges, completely undetectable to even the most well-resourced security teams.
Learning Objectives:
- Understand the technical mechanisms behind GhostPrincipal and GhostDC persistence techniques
- Learn detection and mitigation strategies for SID-based security principal attacks
- Master advanced AD enumeration commands that can uncover hidden artifacts
You Should Know:
1. Understanding the GhostPrincipal Attack Vector
The GhostPrincipal technique creates a user account with full DCSync privileges that cannot be enumerated through standard Active Directory tools. This works by manipulating the security identifier (SID) history and specific AD attributes to create a security principal that exists in the directory but remains invisible to conventional querying methods.
PowerShell: Advanced AD enumeration for hidden objects
Get-ADObject -Filter -Properties | Where-Object {$<em>.objectClass -eq "user" -and $</em>.adminCount -eq 1} | Select-Object Name, ObjectClass, ObjectGUID, WhenCreated, WhenChanged
Step-by-step guide explaining what this does and how to use it:
This PowerShell command queries all AD objects and filters for users with adminCount set to 1, which typically indicates privileged accounts. The command retrieves extended properties including creation timestamps that might reveal hidden accounts. Run this from a domain-joined Windows system with RSAT tools installed and appropriate permissions. The output should be compared against known administrative accounts to identify anomalies.
2. Detecting GhostDC Fake Domain Controllers
Linux: LDAP deep query for domain controllers ldapsearch -H ldap://domaincontroller.domain.com -D "DOMAIN\user" -W -b "DC=domain,DC=com" "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=532480))" name operatingSystem lastLogon
Step-by-step guide explaining what this does and how to use it:
This LDAP query searches for computers with specific userAccountControl flags that identify domain controllers. The value 532480 combines SERVER_TRUST_ACCOUNT (8192) and TRUSTED_FOR_DELEGATION (524288). Execute this from any Linux system with ldap-utils installed, providing valid domain credentials. Compare the results with your known DC inventory to identify unauthorized domain controllers.
3. Advanced SID History Analysis for Detection
PowerShell: Check for SID history anomalies
Get-ADUser -Filter -Properties sidhistory, memberof | Where-Object {$_.sidhistory -ne $null} | Select-Object Name, SamAccountName, SID, SidHistory, MemberOf
Step-by-step guide explaining what this does and how to use it:
This command identifies all users with SID history populated, which is uncommon for standard user accounts and could indicate persistence mechanisms. Run this with Domain Admin privileges to ensure complete visibility. Investigate any accounts with SID history that don’t have legitimate migration explanations.
4. DNS and Network-Based Detection Methods
Linux: Network enumeration for hidden DCs nmap -sS -sU -p 53,88,135,139,389,445,464,636,3268,3269 <subnet_range> --open nbtstat -A <IP_address>
Step-by-step guide explaining what this does and how to use it:
These commands scan for systems responding to critical AD ports and perform NetBIOS name resolution. Run nmap across your domain network segments to identify all systems responding to AD services, then use nbtstat to resolve NetBIOS names. Compare results with your official DC inventory and investigate any discrepancies.
5. Advanced BloodHound Queries for Anomaly Detection
// Cypher Query: Find computers with unexpected privileges MATCH (c:Computer) WHERE c.primarygroup CONTAINS "DOMAIN CONTROLLERS" AND NOT c.operatingsystem CONTAINS "Server" RETURN c.name, c.operatingsystem
Step-by-step guide explaining what this does and how to use it:
This BloodHound Cypher query identifies computers marked as domain controllers but running non-server operating systems. Import recent AD data into BloodHound, then execute this query in the analysis tab. Investigate any results as potential GhostDC instances.
6. Event Log Analysis for Hidden Object Activity
PowerShell: Query security logs for object access
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4662} | Where-Object {$<em>.Properties[bash].Value -eq "%%1911"} | Select-Object TimeCreated, @{Name='Subject';Expression={$</em>.Properties[bash].Value}}, @{Name='Object';Expression={$_.Properties[bash].Value}}
Step-by-step guide explaining what this does and how to use it:
This command searches for specific event ID 4662 (object handle operation) with the GUID %%1911, which relates to operations on hidden objects. Run this on domain controllers with appropriate logging enabled. Correlate findings with known administrative activity to identify suspicious access patterns.
7. Mitigation and Hardening Strategies
PowerShell: Enable advanced AD auditing
auditpol /set /subcategory:"DS Access" /success:enable /failure:enable
auditpol /set /subcategory:"Audit Authorization Policy Change" /success:enable
Set-ADDomain -Identity "domain.com" -Replace @{msDS-Behavior-Version=7}
Step-by-step guide explaining what this does and how to use it:
These commands enable comprehensive AD auditing and set the domain functional level to Windows Server 2016 or higher, which includes security improvements. Execute with Domain Admin privileges and ensure your monitoring solution is configured to collect and alert on these enhanced audit events.
What Undercode Say:
- SID-based persistence represents a fundamental shift in AD attack methodology, moving from attribute-based to identifier-based hiding techniques
- Current commercial security tools lack the fundamental capability to detect these attacks because they rely on standard AD enumeration APIs
The emergence of Makhfi-SID demonstrates that even organizations with mature security programs and significant security investments remain vulnerable to sophisticated persistence techniques. This attack methodology fundamentally challenges the assumption that Domain Admin privileges provide complete visibility into Active Directory. The research indicates that current detection approaches must evolve beyond API-based enumeration to include low-level directory service analysis, network traffic monitoring, and cryptographic verification of domain controllers. Organizations should immediately implement controls that monitor for SID history manipulation and unexpected domain controller presence, while security vendors must develop new detection methods that don’t rely solely on standard AD query interfaces.
Prediction:
Within 12-18 months, SID-based persistence techniques will become standardized in major attack frameworks, forcing a fundamental rearchitecture of Active Directory monitoring and detection capabilities. This will drive adoption of certificate-based authentication systems and accelerated migration to cloud-native directory services that don’t suffer from the same enumeration limitations. The security industry will respond with new agent-based detection systems that operate at the kernel level to monitor directory service operations directly, rather than relying on AD APIs.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Daniel Scheidt – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
