Key takeaway: Reviewing permissions individually cannot find escalation paths, because each link is defensible. The risk exists in the composition, which requires graph analysis to see.
How a Path Forms
A support account can reset passwords for a group. That group contains a service desk account. That account is a local administrator on a set of workstations. One of those workstations has a cached session for a server administrator. That administrator can modify a group policy applied to domain controllers.
Every step was granted for a legitimate reason by someone with authority to grant it. Reviewed in isolation each is unremarkable. Chained, they connect a low-privilege account to complete domain compromise.
This is why permission reviews consistently fail to find escalation risk. The review examines nodes; the risk lives in edges.
The Recurring Patterns
Certain relationships appear in escalation paths repeatedly.
- Password reset rights over an account with higher privilege
- Local administrator on many hosts, which yields whatever credentials are cached on any of them
- Group modification rights over a privileged group
- Ability to modify a group policy or configuration management target that applies broadly
- Delegated permissions on a directory object such as write access to
servicePrincipalName - Certificate template misconfiguration permitting a request for a certificate that authenticates as anyone
The certificate case has become one of the most productive escalation routes in enterprise environments, because templates are configured once and rarely reviewed, and a permissive one converts any authenticated user into any identity.
Finding Them Before an Attacker Does
Manual analysis is not viable — the combinatorics defeat it. Graph tooling is the only practical approach.
BloodHound and equivalent tools collect directory relationships, build a graph, and answer shortest path from any user to domain admin. Cloud equivalents exist for IAM relationships.
Attackers use exactly these tools. Running them yourself is not adopting an exotic technique; it is reading the same map your adversary reads.
The output is typically alarming and immediately actionable, because paths cluster around a few high-degree nodes. Breaking one or two edges frequently eliminates dozens of paths, which makes remediation far more tractable than the initial finding suggests.
Structural Reductions
Tiered administration is the durable fix. Administrative accounts for a tier may only authenticate to systems in that tier, which prevents credential exposure from cascading. A domain administrator never logs into a workstation, so no workstation ever holds a domain administrator credential.
Just-in-time elevation removes standing privilege entirely — an account holds no admin rights until an approved, time-bounded request grants them. That collapses most paths because the privileged edge does not exist at rest.
Reducing local administrator breadth matters too. An account that is local admin on five hundred machines has five hundred opportunities to harvest something better.
The Bottom Line
Run graph analysis against your directory and cloud IAM to enumerate actual paths, then break the high-degree edges that appear in many of them. Adopt tiered administration and just-in-time elevation so that standing privilege — the substance every path is built from — largely disappears.
