Skip to content
attack.paths
Sign in
← RegistryDossier · 6 steps · 5 edges

RODC compromise → cracked NT hashes of revealed accounts

A Read-Only Domain Controller stores password material only for principals on its msDS-RevealedList. Compromising the RODC + cracking those hashes gives you the corresponding users.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: RODC is deployed at a branch site with weaker physical/network controls. The msDS-RevealedDSAs and msDS-RevealedList attributes name the cached principals.

§ Steps

  1. 01
    Authenticate as a revealed userInitial Access
    T1078— Valid Accounts
  2. 02
    Offline crack of revealed account hashesCredential Access
    T1110— Brute Force
  3. 03
    BloodHound for path to DADiscovery
    AD-BLOODHOUND— BloodHound / SharpHound Enumeration
  4. 04
    Extract local NTDS (just-the-revealed scope)Credential Access
    T1003.003— NTDS
  5. 05
    Compromise RODC (local admin / physical)Privilege Escalation
    AD-RODC— RODC Compromise
  6. 06
    Enumerate revealed accountsDiscovery
    AD-RODC-MEMBERS— RODC Revealed Accounts Enumeration

    LDAP query: msDS-RevealedList on the RODC computer object.

§ References

§ Frequently asked

What is the "RODC compromise → cracked NT hashes of revealed accounts" attack path?
A Read-Only Domain Controller stores password material only for principals on its msDS-RevealedList. Compromising the RODC + cracking those hashes gives you the corresponding users. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Authenticate as a revealed user (T1078) — a initial access primitive. Assumed environment: RODC is deployed at a branch site with weaker physical/network controls.
What is the final impact of this kill-chain?
The final step lands on Enumerate revealed accounts (AD-RODC-MEMBERS), which falls under Discovery. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers