Full Report
While investigating LDAP filters and attributes, I completely missed "SDFlags" in my Event 1644 logs. When I finally noticed it, the investigation led to nTSecurityDescriptor, attack path discovery, and a high-confidence detection signature.
Analysis Summary
# Tool/Technique: nTSecurityDescriptor Enumeration via SDFlags
## Overview
This technique involves querying the `nTSecurityDescriptor` attribute within Active Directory (AD) using the `LDAP_SERVER_SD_FLAGS_OID` (1.2.840.113556.1.4.801) control. Attackers use this to bypass permission errors (specifically related to SACLs) and retrieve the Discretionary Access Control List (DACL) and Ownership information of AD objects. This is a critical step in **Attack Path Discovery**, allowing attackers to identify misconfigured permissions (e.g., GenericAll, WriteDacl) that lead to domain escalation.
## Technical Details
- **Type:** Technique / Reconnaissance
- **Platform:** Windows (Active Directory)
- **Capabilities:**
- Bypasses "Access Denied" errors when a standard user tries to read the full security descriptor (which includes the SACL they lack permissions for).
- Specifically requests parts of the security descriptor (Owner, Group, DACL, SACL) using bitmask values.
- Enables automated mapping of AD attack paths.
- **First Seen:** Integrated into SharpHound/BloodHound (various versions); research article published January 15, 2026.
## MITRE ATT&CK Mapping
- **TA0007 - Discovery**
- **T1087.002 - Account Discovery: Domain Account**
- **T1069.002 - Permission Groups Discovery: Domain Groups**
- **T1484 - Domain Policy Modification** (Mapping paths for future modification)
## Functionality
### Core Capabilities
- **Selective Retrieval:** Allows a client to specify exactly which portions of the security descriptor are returned by providing a bitmask in the `SDFlags` field.
- **DACL Mapping:** Retrieves the `nTSecurityDescriptor` attribute, which contains the binary data representing the security settings of an object.
### Advanced Features
- **SDFlags Bitmasking:**
- **0x1:** OWNER_SECURITY_INFORMATION
- **0x2:** GROUP_SECURITY_INFORMATION
- **0x4:** DACL_SECURITY_INFORMATION
- **0x8:** SACL_SECURITY_INFORMATION
- **Example (0x5):** A value of `0x5` (0x1 + 0x4) allows an attacker to request only the **Owner** and **DACL**, successfully retrieving the data even if they do not have the `SeSecurityPrivilege` required to read the SACL (0x8).
## Indicators of Compromise
- **File Hashes:** N/A (Technique-based)
- **File Names:** N/A
- **Registry Keys:** N/A
- **Network Indicators:** LDAP traffic targeting Domain Controllers (default ports 389, 636, 3268, 3269).
- **Behavioral Indicators:**
- **Event ID 1644 (Directory Service):** Look for logs containing the string `SDFlags:` followed by a hex value (e.g., `0x5`).
- **Attribute Selection:** Presence of `nTSecurityDescriptor` in the requested attributes list of an LDAP query.
## Associated Threat Actors
- Broadly used by red teams and threat actors utilizing:
- **BloodHound / SharpHound**
- **Impacket**
- **SOAPHound**
## Detection Methods
- **Behavioral Detection:**
- Monitor **Windows Event ID 1644** on Domain Controllers.
- **Signature Logic:** Flag any LDAP query where the `Attribute selection` includes `nTSecurityDescriptor` and the `SDFlags` field is present.
- High-confidence detection: Standard users rarely query binary security descriptors for the entire directory.
- **Tool-Specific Signatures:** Look for characteristic LDAP filters used alongside SDFlags, such as `(sAMAccountType=805306368)` which SharpHound uses to target user objects.
## Mitigation Strategies
- **Prevention measures:**
- Restricted access to AD management tools.
- Implement "Tiered Administration" to limit the impact of credential theft.
- **Hardening recommendations:**
- Enable **LDAP Interface Event Logging** (Field Engineering registry key) to ensure Event ID 1644 is generated.
- Audit and clean up excessive permissions (e.g., "Allow" ACEs for "Authenticated Users" on sensitive objects).
## Related Tools/Techniques
- **BloodHound:** Uses this technique for graph-based attack path analysis.
- **Impacket:** Uses bitwise OID filters for AD reconnaissance.
- **ADWS (Active Directory Web Services):** An alternative vector for similar queries, often used by SOAPHound.