๐ก ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ฒ ๐๐ถ๐๐ ๐
๐๐ฐ๐๐ถ๐๐ฒ ๐๐ถ๐ฟ๐ฒ๐ฐ๐๐ผ๐ฟ๐ ๐ฝ๐ฟ๐ถ๐บ๐ฎ๐ฟ๐๐๐ฟ๐ผ๐๐ฝ๐๐: ๐ฐ๐ต๐ฒ๐ฐ๐ธ ๐๐ต๐ฎ๐ ๐๐ผ๐๐ฟ ๐๐ผ๐ผ๐น๐ ๐ฎ๐ฟ๐ฒ ๐ฎ๐ฐ๐๐๐ฎ๐น๐น๐ ๐ฟ๐ฒ๐ฝ๐ผ๐ฟ๐๐ถ๐ป๐ด
Active Directory group membership is not only defined by the member / memberOf attributes. A user can also be a member of a group through their primaryGroupID.
๐ง๐ต๐ถ๐ ๐ฐ๐ฟ๐ฒ๐ฎ๐๐ฒ๐ ๐๐ผ๐บ๐ฒ ๐ถ๐ป๐๐ฒ๐ฟ๐ฒ๐๐๐ถ๐ป๐ด ๐ถ๐ป๐ฐ๐ผ๐ป๐๐ถ๐๐๐ฒ๐ป๐ฐ๐ถ๐ฒ๐:
๐น Get-ADGroupMember returns users whose primaryGroupID points to the group.
๐น Get-ADGroup -Properties member does not.
๐น Get-ADUser -Properties memberOf does not show the primary group either.
๐น net group does include these users.
It gets even more interesting with nested groups: recursive queries can miss users whose membership exists through primaryGroupID.
This matters especially for monitoring privileged groups. If your scripts or security tools look only at the group objectโs member attribute, you may not be seeing the complete membership.
โ ๏ธ There is also a technique where an attacker can deny read access to primaryGroupID on an unprotected user object, making the relationship even harder to discover through common AD and PowerShell tooling.
๐ฃ๐ฟ๐ฎ๐ฐ๐๐ถ๐ฐ๐ฎ๐น ๐ฐ๐ต๐ฒ๐ฐ๐ธ:
Get-ADUser -Property primaryGroup,primaryGroupID -Filter {-not(primaryGroupID -like “513”)} |
Select-Object Name,primaryGroupID,primaryGroup
For normal user accounts, 513 represents Domain Users. Non-standard values are therefore worth reviewing rather than assuming your normal group-membership enumeration has caught everything.
โก๏ธ ๐ง๐ต๐ฒ ๐ฏ๐ถ๐ด๐ด๐ฒ๐ฟ ๐๐ฎ๐ธ๐ฒ๐ฎ๐๐ฎ๐: test how your monitoring actually enumerates AD group membership. Different methods can return different answers.
Author: Brandon Colley (๐https://trustedsec.com/blog/adventures-in-primary-group-behavior-reporting-and-exploitation)
