Yet Another Walking Dead of Active Directory

The talk is a follow-up to earlier research on disabled Active Directory accounts, which are often treated as harmless. The speaker shows that disabled users, computers and service accounts can keep dangerous inbound permissions, letting a low-privileged user reach domain admin through hidden ACL, group and delegation paths that BloodHound may not reveal. A real-world inspired case study anchors the walkthrough.

The second half turns to deleted objects and the Active Directory Recycle Bin. Deleted objects keep most of their attributes, so the speaker argues they matter most after domain admin is already gained, for persistence and pivoting, though they can enable lateral movement too. Recoverable leftovers include passwords stored in descriptions, orphaned SIDs still granted share access, SID history, and deleted group managed service accounts. The Python tool Necromancy checks whether the feature is on, restores objects, and calculates gMSA hashes offline once the KDS root key is known. Cobalt Strike object files cover the same checks.

The talk closes with defensive guidance. Disabled and deleted objects should be inventoried along with their inbound rights, and the speaker recommends treating the recycle bin as a place where secrets can survive. The Windows event IDs that record enabling accounts and changes to deleted objects are off by default, so auditing has to be switched on before an EDR can see them. A Sigma rule for these events is published alongside the tools.