GenericAll

GenericAll is the full control permission over an Active Directory object: it subsumes every other right (read and write any attribute, reset the password, change membership, rewrite the DACL). Whoever holds it over an object can do practically anything with it, so it is one of the most direct findings in ACL abuse and one of the juiciest edges BloodHound draws. The concrete abuse depends on the object type.

Over a user. Two paths. The noisy one is resetting their password (breaks the owner's access and is audited); the stealthy one is planting Shadow Credentials by writing the msDS-KeyCredentialLink attribute to authenticate by certificate without touching the password.

# option A: password reset (bloodyAD)
bloodyAD --host <dc> -d <domain> -u <me> -p <pass_me> set password <victim> '<new>'

# option B: shadow credentials (certipy), does not change the password
certipy shadow auto -u <me>@<domain> -p <pass_me> -account <victim>

Over a group. It lets you add yourself as a member. If the group is privileged (Domain Admins, Remote Management Users), it is direct escalation:

net rpc group addmem "<group>" <me> -U "<domain>/<me>%<pass_me>" -S <dc>

Over a computer. It enables configuring RBCD (by writing msDS-AllowedToActOnBehalfOfOtherIdentity) to request tickets on behalf of any user, or again Shadow Credentials against the machine account.

Verification. After the abuse, check it instead of assuming: a login with the new password / the certificate TGT, or net rpc group members "<group>" to see you now appear. The check is the proof the permission took effect.

Nuance. GenericAll over a user or group is full control over that object, not over the domain: it only escalates if the target is already privileged or has further edges towards someone who is. It is the superset of GenericWrite, WriteDACL and ForceChangePassword: anything they do, GenericAll can too.

How to detect it. Full control shows up through the effect it leaves in the directory, not the permission itself. A password reset generates Event ID 4724 (an attempt was made to reset an account's password); adding yourself to a group, 4728/4732/4756 (a member was added to a security-enabled group); and writing a sensitive attribute such as msDS-KeyCredentialLink (Shadow Credentials) or msDS-AllowedToActOnBehalfOfOtherIdentity (RBCD), an Event ID 5136 (a directory service object was modified), which requires enabling Audit Directory Service Changes and a SACL on the object. The defensive key is correlation: the actor behind those changes is rarely a legitimate directory-administration account.

Defence. Least privilege: do not grant full control unless genuinely needed, review inherited ACEs and periodically audit who holds GenericAll over Tier-0 accounts and groups.