PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

AD Group Risks: Hidden Powers of Account Operators

semperis.com | blog | #active-directory | #privilege-escalation | #windows-security | #red-team | #lateral-movement | #account-operators
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Account Operators looks harmless without 'admin' in its name, yet it grants broad control over domain identities—here is how attackers abuse it to escalate.
Published
Collected

Related coverage

blog · semperis.com
AD Group Risks: Hidden Powers of Account Operators
# AD Group Risks: Hidden Powers of Account Operators * AD Security 101 * Aug 28, 2026 * Read 5 MIN * What can Account Operators actually do? * Why does the Account Operators group become dangerous...
blog · semperis.com
AD Group Risks: How Cryptographic Operators Dangers Escalate Quickly
At first glance, the Cryptographic Operators group doesn’t look scary. But it sits dangerously close to the systems that define trust—and in Windows, trust is everything. Here’s how to head off risk in your environment.
blog · specterops.io
Beyond Tier Zero
SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.
blog · netspi.com
Running LAPS Around Cleartext Passwords
Explains how Microsoft LAPS stores local admin passwords in LDAP, and how incorrect delegation on ms-MCS-AdmPwd can expose cleartext credentials that aid lateral movement.
blog · netspi.com
5 Ways to Find Systems Running Domain Admin Processes
Details five ways to find systems running Domain Admin processes: checking locally, querying domain controllers for sessions, scanning remote tasks, NetBIOS enumeration, and token spraying.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
Back