Active Directory Security: Abusing Display Specifiers

Demonstrates creating, importing, exporting, and altering SQL Server CLR assemblies to execute OS commands, escalate to sysadmin, and persist, with new PowerUpSQL functions for AD-wide campaigns.

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

SID History injection abuses a domain-migration feature: attackers inject a Domain Admins SID into an account's SID History to escalate silently, bypassing group-membership checks.

Semperis research on spotting DCShadow—the Mimikatz technique that impersonates a domain controller to inject stealthy changes into AD—moves from 'how' to 'from where', helping identify the rogue hosts used for hidden persistence.

How DCShadow works: any Windows server can impersonate a domain controller and inject changes into AD's replication stream—bypassing security event logs, with no patch to close the technique.