Adventures in Primary Group Behavior, Reporting, and Exploit...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://trustedsec.com/blog/adventures-in-primary-group-behavior-reporting-and-exploitation
• Blog Title: Adventures in Primary Group Behavior, Reporting, and Exploitation
• Suggested Section: Windows Hardening -> Active Directory Methodology (add/update content near DCShadow / Privileged Groups / AD enumeration to cover primaryGroupID-based effective membership, tooling discrepancies, and recursion edge cases)

🎯 Content Summary

Title/Context
The post (TrustedSec, dated January 22, 2026) deep-dives how Active Directory (AD) determines and reports group membership when a user’s primaryGroupID changes, and why this creates real-world monitoring/IR blind spots. It also validates common attacker assumptions (e.g., “set primaryGroupID to Domain Admins and you’re stealthy”) and shows what is and isn’t actually possible.

How AD primary group membership works...

🔧 Technical Details

Changing AD effective group membership can be achieved by modifying a user’s primaryGroupID (e.g., setting primaryGroupID=512 to gain effective Domain Admins privileges) using directory-write primitives such as DCShadow (e.g., via mimikatz). However, primary group changes are coupled to membership semantics: modifying PGID replaces the primary group relationship and strips membership from the previously configured primary group, preventing a clean “decoupled/hidden” membership state.

Enumeration/monitoring evasion can be achieved by exploiting tooling discrepancies in how AD membership is reported. Queries that read only the group’s member attribute or the user’s memberOf backlink (e.g., Get-ADGroup -properties member(s), Get-ADUser -properties memberOf, ADSI Edit viewing member) can omit primary-group-derived members, while higher-level resolvers (e.g., Get-ADGroupMe...

🤖 Agent Actions

Updated src/windows-hardening/active-directory-methodology/dcshadow.md with a new section detailing primaryGroupID abuse, enforcement behavior, and enumeration blind spots (including tool discrepancies, nested-group recursion gaps, and DACL-based hiding). Added detection/monitoring PowerShell snippets and consolidated references (including the TrustedSec post).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://trustedsec.com/blog/adventures-in-primary-group-behavior-reporting-and-exploitation

Content Categories: Based on the analysis, this content was categorized under "Windows Hardening -> Active Directory Methodology (add/update content near DCShadow / Privileged Groups / AD enumeration to cover primaryGroupID-based effective membership, tooling discrepancies, and recursion edge cases)".

Repository Maintenance:

• MD Files Formatting: 941 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0