AD-DACL-ADDMEMBERPrivilege Escalation

AddMember (WriteProperty on member)

Write 'member' attribute to add an account to a group, including Domain Admins.

§ Where this technique fits

AD-DACL-ADDMEMBER is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

GenericWrite on Domain Admins → AddMember → DA
A misconfigured 'member' attribute write on a privileged group lets the attacker silently add themselves as a Domain Admin.
step 3 / 5

§ What commonly comes next

01
Valid Accounts
T1078 · Initial Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

GenericWrite on Domain Admins → AddMember → DA

§ What commonly comes next