One Permission Away from Domain Takeover | Ep 201
Show notes
One dangerous permission in Active Directory can be all it takes for an attacker to turn a single compromised account into full control of your domain. On our internal pen tests, that one misconfiguration is often the first domino. Everything after it is blast radius.
In this episode, Spencer and Brad explain why dangerous permissions pile up in the first place, why they stay hidden for years, and what happens downstream when nobody finds them. They also cover where to start cleaning things up without buying a single new tool.
In this episode:
- Why permissions accumulate through decommissions, upgrades, vendor installs, and “temporary” fixes that never get undone
- How a Citrix install wizard that needed domain admin left behind an over-permissioned mess
- How employee turnover and lost tribal knowledge make old access riskier to touch
- Why inherited permissions, nested groups, and object ownership keep risk out of sight
- Why BloodHound can surface tens of thousands of attack paths in one environment
- Active Directory vs. Entra, and why the size of your attack surface is the better question
- The downstream risks: privilege escalation, unauthorized access, lateral movement, and service account abuse
- How attackers cause serious damage without ever reaching domain admin
- Where to start: audit what broad groups like Domain Users, Authenticated Users, and Everyone can reach, beginning with your Tier 0 assets
- Free tools to get started, including ADeleginator, PingCastle, Purple Knight, and BloodHound
Worried about what’s hiding in your Active Directory? SecurIT360’s internal penetration testing finds the dangerous permissions and attack paths before threat actors do. Reach out at securit360.com.
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com