The Hidden Backdoor in Your Active Directory: How Special Identity Groups Are Silently Compromising Your Entire Network

By /

Listen to this Post

Featured Image

Introduction:

Active Directory’s special identity groups, such as ‘Everyone’ and ‘Authenticated Users’, are often overlooked yet represent a critical attack surface. These groups implicitly include nearly every account in the domain, and misconfigured permissions granted to them can lead to rapid, widespread domain compromise. This article explores how to leverage BloodHound to identify and remediate these dangerous permission pathways.

Learning Objectives:

  • Understand the inherent risks of Active Directory special identity groups.
  • Learn to use BloodHound Cypher queries to map dangerous permission inheritance.
  • Develop a remediation strategy for permissions granted to special principals.

You Should Know:

1. Identifying Special Identity Group Membership with BloodHound

The `ClaimSpecialIdentity` edge in BloodHound is key to mapping these relationships. This Cypher query visualizes all groups that claim a special identity and their outbound permissions.

`MATCH p = (:Group)-[:ClaimSpecialIdentity]->(:Group)–>(:Base) RETURN p`

Step-by-step guide:

  1. Open your BloodHound interface and navigate to the Query tab.
  2. Ensure you have imported the latest SharpHound data to have accurate `ClaimSpecialIdentity` edges.
  3. Paste the query above into the Cypher input field and execute it.
  4. BloodHound will return a graph showing groups like ‘Everyone’ or ‘Authenticated Users’ and any permissions they have over Active Directory objects (Users, Computers, Groups). Analyze these paths to identify dangerous control rights like GenericAll, WriteOwner, or ForceChangePassword.

2. Enumerating Dangerous Permissions on Critical Objects

Finding the groups is the first step; the next is understanding what they control. This query finds all objects a special identity has control over.

`MATCH p=(g:Group)-[r:ClaimSpecialIdentity]->(sid:Group)-[bash]->(n) WHERE r2.isacl=true RETURN p`

Step-by-step guide:

  1. This query expands on the first by specifically checking for ACL-based permissions (isacl=true).
  2. Execute the query in BloodHound. Hover over the edges (lines) between the special identity group and the target object to see the specific permissions (e.g., WriteProperty, GenericWrite).
  3. Pay special attention to paths leading to high-value targets like Domain Admins groups, Tier 1 servers, or sensitive user accounts. Any write permission here is a direct path to privilege escalation.

  4. Auditing File System Permissions Granted to Special Identities
    Dangerous permissions aren’t limited to AD objects. Special identities often have excessive file or folder rights. Use PowerShell to audit a share.

    `Get-Acl -Path “C:\CorporateShare” | Select-Object -ExpandProperty Access | Where-Object {($_.IdentityReference -like “Everyone”) -or ($_.IdentityReference -like “NT AUTHORITY\Authenticated Users”)} | Format-List`

Step-by-step guide:

  1. Open PowerShell with administrative privileges on a Windows machine or using a PSSession on a target.
  2. Run the command, replacing `”C:\CorporateShare”` with the path you want to audit.
  3. The output will list all access control entries (ACEs) for the ‘Everyone’ and ‘Authenticated Users’ groups on that path. Look for Modify, Write, or `FullControl` rights, especially on directories containing executables or scripts.

4. Hardening Kerberos: Preventing RBCD Attacks

The ‘Authenticated Users’ group can often create computers, which can be abused for Resource-Based Constrained Delegation (RBCD) attacks. Harden this setting via Group Policy.

`Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> “Add workstations to domain” -> Define this policy setting and remove the Authenticated Users group.`

Step-by-step guide:

1. Open the Group Policy Management Console (GPMC.msc).

  1. Create a new GPO or edit an existing one linked to the domain.

3. Navigate to the path detailed above.

  1. Enable the policy setting and ensure only authorized groups (e.g., a specific security group for helpdesk) are listed. Remove ‘Authenticated Users’ if present.
  2. Link the GPO to the appropriate OU and force a `gpupdate /force` on a test machine to verify the setting applies correctly.

5. Mitigating Abusable Write Permissions with ACL Cleanup

If you find abusable permissions, you must remove them. Use the `Remove-ADObjectPermission` PowerShell cmdlet or the Active Directory Users and Computers (ADUC) GUI.

PowerShell method to remove 'WriteProperty' on a user for 'Authenticated Users'
<h2 style="color: yellow;">$UserDN = "CN=TestUser,OU=Users,DC=undercode,DC=local"</h2>
<h2 style="color: yellow;">$SID = (New-Object System.Security.Principal.NTAccount("Authenticated Users")).Translate([System.Security.Principal.SecurityIdentifier])</h2>
<h2 style="color: yellow;">$ACL = Get-ACL -Path "AD:\$UserDN"</h2>
$ACL.PurgeAccessRules($SID) Removes all access rules for the specified SID
<h2 style="color: yellow;">Set-ACL -Path "AD:\$UserDN" -AclObject $ACL

Step-by-step guide:

  1. Caution: Test this in a lab environment first. Incorrect ACL modification can break functionality.
  2. Identify the DistinguishedName (DN) of the vulnerable AD object.
  3. The PowerShell script above connects to Active Directory, retrieves the ACL for the object, purges all access rules for the ‘Authenticated Users’ group, and writes the ACL back.
  4. Alternatively, use ADUC: Right-click the object -> Properties -> Security -> Advanced. Find entries for ‘Everyone’ or ‘Authenticated Users’, select them, and click ‘Remove’.

What Undercode Say:

  • Silent Persistence: Attackers don’t need to create backdoor accounts. They can simply leverage these always-present, often-overpermissioned groups for persistence and lateral movement, making their activity blend in with normal noise.
  • Configuration Drift is the Enemy: These vulnerabilities are almost never introduced maliciously. They accumulate over years of operational needs, legacy application support, and misconfigurations, creating a toxic trust web that is difficult to untangle.
    The pervasive nature of special identity groups makes them a perfect vehicle for attackers. Defenders must shift their mindset from hunting for malicious artifacts to continuously auditing and correcting inherent trust weaknesses. The sheer scale of potential exposure means automated tools like BloodHound are not just beneficial but essential for maintaining a secure posture. Relying on manual review is a guaranteed path to oversight and eventual compromise.

Prediction:

The exploitation of implicit trust relationships, particularly through special identities and similar constructs, will become the dominant attack vector in enterprise networks. As defenders get better at detecting anomalous account creation and explicit permission grants, attackers will increasingly “live off the land” using these built-in permissions. This will drive a new market for automated identity security posture management tools that continuously monitor and hard these trust configurations, making them as critical as traditional vulnerability scanners are today.

🎯Let’s Practice For Free:

IT/Security Reporter URL:

Reported By: Specterops Bloodhoundbasics – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: