---
id: 5977
title: "How Attackers Can Use Active Directory Primary Group Membership for Defense Evasion"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/how-attackers-can-use-primary-group-membership-for-defense-evasion/"
published_at: "2021-09-20T21:34:02Z"
tags: ["active-directory", "privilege-escalation", "detection", "defense-evasion", "primary-group-id", "dacl"]
phying_url: "https://phying.com/item/5977"
lang: en
---

# How Attackers Can Use Active Directory Primary Group Membership for Defense Evasion

## Summary

A little-known DACL trick lets attackers use the Primary Group ID attribute plus a specific ACE to hide their membership in a group they belong to—no permissions on the group needed—concealing malicious users; detection guidance included.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2021-09-20T21:34:02Z
- **Original:** https://www.semperis.com/blog/how-attackers-can-use-primary-group-membership-for-defense-evasion/
- **Phying News:** https://phying.com/item/5977