AD-RODC-MEMBERSDiscovery

RODC Revealed Accounts Enumeration

Enumerate msDS-RevealedDSAs / msDS-RevealedList to find what credentials a RODC can disclose.

§ Where this technique fits

AD-RODC-MEMBERS is catalogued under the Discovery tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

RODC compromise → cracked NT hashes of revealed accounts
A Read-Only Domain Controller stores password material only for principals on its msDS-RevealedList. Compromising the RODC + cracking those hashes gives you the corresponding users.
step 2 / 6

§ What commonly comes next

01
NTDS
T1003.003 · Credential Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

RODC compromise → cracked NT hashes of revealed accounts

§ What commonly comes next