Reading an Authorization Graph: Membership, Object Control, Sessions, and Management Relationships.

1. Core mechanism

This lesson ties an edge in the graph back to the directory or runtime evidence on which it rests. A path is only a candidate for applicability once the subject, target, scope, and intervening runtime conditions of every edge have been verified; final resource authorization must still be evaluated separately.

Interfaces and specifications

• membership edge: a principal's security-group membership or nested-group path.
• object-control edge: a DACL ACE for a specific object, property, or control-access right.
• session edge: an observed, time-bounded session for a principal on a manageable target.
• management edge: the separate authorization boundary required to perform a management operation on the target.
• AccessCheck: the SIDs in the token, the requested access, and the object's DACL are evaluated together.
• edge freshness: a directory snapshot, session telemetry, and ACL may not represent reality at the same point in time.

Read the relationship contract, not just the node

The User-A -> Group-B edge in the graph says that User-A may be a member of Group-B; the Group-B -> Object-C edge says that an ACE may grant Group-B a specific right. Collapsing both edges into a single 'admin' label hides which change would break the path.

For an object-control edge, read the ACE trustee, access mask, any object-type GUID, whether it is inherited, and the target object. 'Write Property' and 'Generic All' do not promise the same effect; a property-specific ACE applies only to the relevant attribute.

A graph path is not runtime evidence

The ability to draw a path does not prove that every transition can be used at the same time. Token group membership may have changed, an ACE may be deny-only or restricted to a narrower object type, and the network, service acceptance, or resource ACL may block the path separately.

A session edge is especially different: it is not a persistent directory permission, but a fact bound to the observation time and collection scope. An old session record does not mean that the session still exists today.

State and data flow

1. Classify each edge as membership, object-control, session, or management.
2. Record the object, trustee, right, and observation time on which the edge rests.
3. For the next edge, verify token, ACL, and runtime preconditions separately.
4. Establish the actual authorization result on the resource independently of the graph.

2. Exploitation

Broken trust assumption

An attacker has obtained control of at least one relationship shown in the graph or is attempting to use an incorrectly interpreted edge; this lesson does not provide operational steps for a real environment.

Technical prerequisites

• Every object-control edge on the path is genuinely applicable with the correct trustee and required access mask.
• The runtime portion is current; the target is reachable and later authorization boundaries can also be passed.

Exploitation mechanism

The graph shows an attacker which control planes might be combined. But a broad path is only as real as its weakest edge: a stale session, removed group membership, or an overly broad reading of a property-specific ACE invalidates the path.

The shortest path is not the strongest evidence

A tool may show a short path between two nodes; that is useful for prioritization, but it is not exploit evidence. Labeling the path's impact as 'domain compromise' before reducing its edges to source artifacts leads to the wrong remediation.

Owner, WRITE_DAC, and direct write rights are distinct mechanisms. The assessment must keep the intervening permission-change step visible.

3. Defense & Detection

Telemetry scope

• For every high-impact graph edge, retain the object DN, trustee SID, ACE type, mask, and object-type information.
• Separate the membership source, nested-group resolution, and snapshot time.
• Add the observation source, collector scope, and last-seen time to session edges.
• Record separately the narrowest permission change that would close the path and its expected business impact.

Events and relevant fields

• With an appropriate SACL, Event 4662 can record a monitored directory-object operation. ObjectType identifies the class of the object that was accessed; property or property-set GUIDs associated with the operation appear in Properties. The event alone does not prove that the full graph path worked or that later resource access succeeded.
• Session telemetry depends on visibility coverage; its absence does not show that a session never existed.

Make the graph finding auditable

An edge report should include not only source and target names, but also the artifact that produced it. In this example, the ACE grants Write Property for a specific member-property GUID; the parser reads the ACE but does not perform AccessCheck or change group membership.

This record makes it possible to measure the same edge again after remediation. Whether the remediation disrupts endpoint access is a separate change-validation task.

Detection logic · XPath

*[System[(EventID=4662)]]

Query assumptions

• This XPath example selects Event 4662 records from the chosen channel; it does not filter by the member-attribute GUID.
• For a property-specific review, ObjectType identifies the object class, while Properties carries class/property-set GUIDs associated with the operation. Look for the member-attribute GUID in Properties and interpret it with AccessMask, Subject, and ObjectName.
• Producing Event 4662 depends on the relevant directory object's SACL and success/failure audit settings; this query was not run against a live dataset.

False positives

• Legitimate group administration may produce an event with the same object type.
• The event does not show that the entire path worked or what the subsequent resource-authorization result was.

Hardening

• Manage privileged group membership and sensitive-object ACEs with separate owners and change control.
• Do not replace property-specific delegation with Generic All or broad Write Property.
• Require stale-data and runtime-verification fields in the graph report.

Read the examples

O:BAG:BAD:(OA;;WP;bf9679c0-0de6-11d0-a285-00aa003049e2;;S-1-5-21-1987654321-1234567890-2468013579-4101)

Two reality checks

Assumption: If a path appears in the graph, every edge is applicable and the result is guaranteed.

In fact: The right's scope, token/ACL evaluation, freshness, and runtime gates for every edge must be verified separately; resource authorization is an independent final decision.

Assumption: Write Property in an ACE means full control over every attribute.

In fact: An object-specific ACE can be narrowed by an object-type GUID; in this example, the right supports only the edge for the member attribute.

Sources

• Microsoft · How DACLs control access to an object
  AccessCheck requested access, token SID, and DACL evaluation.
• Microsoft · Member attribute
  Member-attribute schema identity and group-membership role.
• Microsoft · [MS-ADA2]: Attribute member
  The member attribute identifies group members and its schemaIdGuid is bf9679c0-0de6-11d0-a285-00aa003049e2.
• Microsoft · 4662(S, F): An operation was performed on an object
  Appropriate SACL/audit settings govern event generation; ObjectType identifies the accessed object's class, Properties carries class/property-set GUIDs associated with the operation, and AccessMask/Subject provide operation context.
• Microsoft · Consuming Events (Windows Event Log)
  Windows Event Log XPath supports event selectors such as *[System/Level=1] and compound predicates; selectors must select event nodes. The sample query selects EventID 4662, with property-GUID inspection left to follow-up parsing.