Detections
Analytics
Conflicting Security Principals
low
Language:
Description
The multi-master replication system of Active Directory generally works well, but conflicts can arise for various reasons and require manual resolution.
Solution
To enhance infrastructure consistency and prevent identity confusion, remove duplicated security principals.
See Also
Active Directory: Duplicate Object Name Resolution
sAMAccountName is always unique in a Windows domain… or is it?
Using conflicting objects in Active Directory to gain privileges
Indicator Details
Name: Conflicting Security Principals
Codename: C-CONFLICTED-OBJECTS
Severity: Low
- Tactic: TA0003 - Persistence
- Techniques: T1136 - Create Account
- Tactic: TA0005 - Defense Evasion
- Techniques: T1036 - Masquerading
- Tactic: TA0040 - Impact
- Techniques: T1489 - Service Stop