ACL abuse

Access Control List (ACL) abuse provides the attacker with unique and almost undetectable ways to escalate privileges, perform lateral movement, and achieve malware-less persistence.

Note

Some of the most notable and comprehensive research on that theme was presented by SpectreOps (https://specterops.io/wp-content/uploads/sites/3/2022/06/an_ace_up_the_sleeve.pdf). We will refer to some parts of the research here and in the next chapter.

We will start with essential theory as an introduction. Each object in Active Directory has a security descriptor. Each object has associated lists of Access Control Entities (ACEs), which create two lists called the Discretionary Access Control List (DACL) and the System Access Control List (SACL). ACEs define which security principals have rights over the object. The SACL has great detection potential as it can be used for auditing access attempts. Object owners can modify the DACL. When we speak about domain objects, we are focusing...