GenericWrite on Domain Admins → AddMember → DA
A misconfigured 'member' attribute write on a privileged group lets the attacker silently add themselves as a Domain Admin.
§ Context
Assumed environment: typically a legacy ACL granted Account Operators / a service principal WriteProperty on `member`. Often invisible to standard audits because no group GUI shows the right.
§ Steps
- 01Token now contains DA SIDInitial AccessT1078— Valid Accounts
Re-auth (klist purge) to pick up the new group membership.
- 02Compromised principal w/ GenericWrite on groupInitial AccessT1078— Valid Accounts
- 03Identify writable groupDiscoveryAD-BLOODHOUND— BloodHound / SharpHound Enumeration
BloodHound 'AddMember' / 'GenericWrite' edge against Domain Admins.
- 04DCSyncCredential AccessT1003.006— DCSync
- 05Add attacker to Domain AdminsPrivilege EscalationAD-DACL-ADDMEMBER— AddMember (WriteProperty on member)
net group 'Domain Admins' <me> /add /domain (or via ldapmodify)
§ References
- T1078Valid Accounts
- T1003.006DCSync
§ Frequently asked
- What is the "GenericWrite on Domain Admins → AddMember → DA" attack path?
- A misconfigured 'member' attribute write on a privileged group lets the attacker silently add themselves as a Domain Admin. It chains 5 steps drawn from real-world offensive-security techniques.
- What starting position does this attack require?
- The first step is Token now contains DA SID (T1078) — a initial access primitive. Assumed environment: typically a legacy ACL granted Account Operators / a service principal WriteProperty on `member`.
- What is the final impact of this kill-chain?
- The final step lands on Add attacker to Domain Admins (AD-DACL-ADDMEMBER), which falls under Privilege Escalation. From here, an operator typically pivots into post-exploitation or maintains persistence.
- How can defenders detect or prevent this attack?
- Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.
§ Related dossiers
- Shared techniques3
Unconstrained delegation → Capture DC TGT → DCSync
Compromise a host with TRUSTED_FOR_DELEGATION, coerce a DC to authenticate to it, harvest the DC's TGT from its LSASS, then DCSync.
- Shared techniques2
Leaked legacy VPN credential → ransomware (Colonial-class)
A dormant VPN account whose password appeared in a third-party breach is still active, has no MFA enforced. Sign in, recon AD, deploy ransomware across the estate.
- Shared techniques2
Citrix Bleed → steal authenticated session → MFA bypass
Send a long Host header to a vulnerable NetScaler — memory disclosure leaks an authenticated session token already past MFA. Replay the token to log into the corporate VPN.
- Shared techniques2
mitm6 IPv6 SLAAC → NTLM relay → DA
Even when IPv4 is hardened, Windows clients prefer IPv6 with default DHCPv6. mitm6 makes the attacker the IPv6 DNS server, advertises wpad, and relays the captured NTLM to LDAPS for RBCD.
- Shared techniques2
LAPS read → local admin on every endpoint
A delegated 'helpdesk' group gains read access to ms-Mcs-AdmPwd. Compromising any member of that group cascades to local admin on every LAPS-managed machine.
- Shared techniques2
PetitPotam + ADCS ESC8 → Domain Controller takeover
Coerce a DC's machine account to authenticate to the attacker, relay that NTLM to the ADCS HTTP web-enrollment endpoint, and obtain a DC certificate for full domain compromise.