AD-GROUP-DNSADMINSPrivilege Escalation

DnsAdmins → SYSTEM on DC

Members can load a DLL through the DNS service (dnscmd ServerLevelPluginDll) — runs as SYSTEM.

§ Where this technique fits

AD-GROUP-DNSADMINS is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

DnsAdmins membership → SYSTEM on the DC
DnsAdmins members can load a DLL via the DNS service ServerLevelPluginDll registry value — the service runs as SYSTEM on the DC.
step 3 / 5

§ What commonly comes next

01
Command and Scripting Interpreter
T1059 · Execution
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

DnsAdmins membership → SYSTEM on the DC

§ What commonly comes next