Turning Your Active Directory into the Attacker’s C2
Demonstrates how red teams can weaponize Active Directory Group Policy Objects (GPOs) into a stealthy, native command-and-control infrastructure.
Summary
Active Directory as Centralized Infrastructure
Active Directory (AD) is designed to coordinate and manage enterprise computers, users, and security settings across distributed corporate networks.
Weaponizing Group Policy Objects for C2
Quentin Roland and Wilfried Bécard show how attackers who obtain GPO modification rights can repurpose Group Policy replication into a covert command-and-control mechanism that requires no external network connections.
Persistence and Privilege Escalation Across Network Segments
By embedding scheduled tasks, script execution policies, and immediate task items within replicated GPO templates, operators distribute commands to thousands of domain-joined systems simultaneously.
Detecting Malicious GPO Manipulation
Defending Active Directory against GPO weaponization requires monitoring directory replication logs, enforcing tiered administration models, and auditing GPO permissions.
Related talks
Main Stage·34 min
Yuval Gordon
Discloses critical design flaws in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling unprivileged domain users to become Domain Admins.
Main Stage·39 min
Mehdi Elyassa
Explores new offensive attack paths and privilege escalation techniques targeting Microsoft System Center Configuration Manager (MECM/SCCM) in enterprise networks.
Main Stage·21 min
Antoine Goichot
Discloses subtle logic and authorization bypasses in Microsoft Windows Local Administrator Password Solution (LAPS) that enable credential theft.