Active › Module 6 › Lesson 2
ACL Paths Named
ACL abuse paths named at literacy — GenericAll, WriteDACL, force-change-password — graph awareness on $LAB_AD, defenses not takeover recipes.
Visual · t25_acl_paths_named
ACL paths = named permission edges. BloodHound literacy. $LAB_AD only. Original Cyberlium.
Opening
BloodHound shows paths — defenders fix ACLs; attackers need authorization before touching any forest.
ACL-based privilege paths in AD include edges like GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword, and AddMember on groups — literacy for reading BloodHound-style graphs on YOUR $LAB_AD. Analyst names the edge, identifies excessive delegation on service accounts or helpdesk groups, and recommends remediation: remove dangerous ACEs, implement tiering, regular ACL audits. Cyberlium teaches path naming and defender cleanup — NOT full stranger-domain escalation cookbooks, NOT exporting real enterprise BloodHound zips from leaks, NOT 'GenericAll to DA' homework against production. On $LAB_AD per brief: document one named path from lab graph with impact literacy and fix recommendation. Purple tie-in: path existed because ACL hygiene failed.
1. Named ACL edges
GenericAll, WriteDACL, ForceChangePassword, AddMember — one-line each for graph reading.
Path = chain of edges from low-priv lab user to high-value object — literacy only.
Command guide
Try these commands — Named ACL edges
═══ WINDOWS / POWERSHELL (Lab DC) ═══
Audit users and groups with 'Replicating Directory Changes' rights (DCSync privilege)
Command — copy this
Import-Module ActiveDirectory
(Get-Acl "AD:\$((Get-ADDomain).DistinguishedName)").Access | Where-Object {
$_.ActiveDirectoryRights -match "ExtendedRight" -and
($_.ObjectType -eq "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2" -or $_.ObjectType -eq "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2")
} | Select-Object IdentityReference, ActiveDirectoryRightsAudit unconstrained or constrained delegation accounts
Command — copy this
Get-ADAccount -Filter {TrustedForDelegation -eq $true} | Select-Object Name, SamAccountNamePrimary tools to practice this lesson: curl, grep. Reference sites: MITRE T1222 ACL abuse (https://attack.mitre.org/techniques/T1222/); BloodHound ACL edges (https://bloodhound.readthedocs.io/); Microsoft AD ACLs (https://learn.microsoft.com/en-us/windows/win32/ad/active-directory-security-descriptors). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender remediation
Remove unnecessary ACEs, use AdminSDHolder protection awareness, delegate minimally.
Regular BloodHound collection on YOUR tenant with blue-team lens — not attack export.
3. Scope refuse
No ACL abuse against stranger domains, no leaked enterprise graphs as lab input.
Findings describe misconfig on $LAB_AD — not live escalation proof on unauthorized AD.
4. What you ship: ACL paths literacy card
Five named edges + one lab path row + remediation line + $LAB_AD scope.
5. What you record before the next lesson
ACL paths literacy card path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import stranger BloodHound zip and execute GenericAll path on production.
Right
ACL paths named with defender remediation. Next: Delegation Named.
Mission: ACL paths literacy card
1) Define five ACL edges one line each. 2) Document one $LAB_AD path row. 3) Write remediation for that path. 4) NEVER stranger-domain ACL abuse.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “GenericAll vs WriteDACL — defender fix order?”
Knowledge Check
APPLY: ACL paths literacy teaches:
Multiple choice
Knowledge Check
APPLY: True or False: BloodHound on stranger enterprise zip is lab.
True or False
Knowledge Check
APPLY: ForceChangePassword edge means:
Multiple choice