A DACL backdoor is persistence created by editing the discretionary access control list (DACL) on Active Directory objects to grant an attacker hidden rights, for example DCSync on the domain, GenericAll on a privileged group, or password-reset on an admin account. The rights survive password resets and blend into normal object permissions, so they are easy to miss. Defend by auditing ACLs on tier-0 objects with BloodHound and monitoring for DACL changes.
What a DACL backdoor is
Access in AD is controlled by DACLs on each object. Powerful rights, such as Replicating Directory Changes (DCSync), WriteDACL, GenericAll, or force-reset-password, can be granted to any principal. An attacker who reaches those permissions once can grant themselves a durable foothold that looks like an ordinary ACL entry, not an obvious backdoor account.
How the attack works
With enough rights the attacker adds an ACE granting themselves control, for example DCSync on the domain via Add-DomainObjectAcl -TargetIdentity 'DC=corp,DC=local' -Rights DCSync, or GenericAll on a privileged group, or password-reset on an admin. From then on they can dump hashes or seize the account at will. Impacket's dacledit does the same over the network. Payloads are shown for defensive testing.
How to defend against it
Baseline and audit the ACLs on tier-0 objects (the domain head, privileged groups, admin accounts, the AdminSDHolder) and alert on changes to them. Map object permissions with BloodHound the way attackers do, remove unexpected rights, and watch for grants of DCSync, WriteDACL, and GenericAll to non-tier-0 principals.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]Microsoft: How access tokens and ACLs work(Microsoft)
A single hidden ACE can give an attacker your domain on demand. Talk to a security expert about auditing your tier-0 permissions.