AD-MAQInitial Access

MachineAccountQuota Abuse

Default ms-DS-MachineAccountQuota = 10 lets any user create computer accounts — primitive for RBCD, ESC8, noPac.

§ Where this technique fits

AD-MAQ is catalogued under the Initial Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

MachineAccountQuota abuse → RBCD takeover of a server
Default ms-DS-MachineAccountQuota = 10 lets any authenticated user create a computer account, which can then be used as the source principal in an RBCD attack.
step 2 / 5

§ What commonly comes next

01
Resource-Based Constrained Delegation (RBCD) Abuse
AD-RBCD · Lateral Movement
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

MachineAccountQuota abuse → RBCD takeover of a server

§ What commonly comes next