Attackers Exploit Active Directory Sites to Escalate Privileges and Compromise Domain

Security researchers have uncovered a dangerous attack vector targeting Active Directory Sites, a critical yet often overlooked component of enterprise network infrastructure. According to a recent technical analysis by Quentin Roland, attackers can exploit ACL-based attack paths within AD Sites to escalate privileges and potentially compromise entire domains.

The vulnerability exists because sites can be associated with access control lists (ACLs) that, when improperly configured, allow attackers to move laterally across domains. Researchers have identified that sites can contain clients and domain controllers from multiple, distinct domains within a forest, creating a cross-domain relationship that underpins sophisticated privilege escalation.

The approach relies on site-based ACLs and GPO exploitation techniques to move between domains without triggering traditional security alerts, and BloodHound enhancements are now being used to visualise these site attack paths. Organisations should audit their Active Directory site configurations and permissions and consider updating BloodHound to help identify risky site-related paths.