Threat reportThreat IntelligenceTL-2026-4142
Simulating legitimate Active Directory services (SMB/LDAP) on the network: GPO exploitation research (Synacktiv)
Simulating legitimate Active Directory services (SMB/LDAP) (TL-2026-4142), also tracked as GPO poisoning via simulated AD services, is a medium-severity tracked intrusion set, first published 2026-10-22. It has no confirmed attribution, affects Microsoft Active Directory Group Policy (domain-joined Windows, references 1 CVE (CVE-2026-54121), maps to 6 MITRE ATT&CK techniques (T1036, T1053.005, T1078.002), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4142
- Threat ID
- TL-2026-4142
- Also known as
- GPO poisoning via simulated AD services
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, energy
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Simulating legitimate Active Directory services (SMB/LDAP)
Malware and tooling: BloodHound - S0521, GPOddity, GroupPolicyBackdoor, Impacket - S0357, OUned, Scapy
How Simulating legitimate Active Directory services (SMB/LDAP) works
Synacktiv research by Quentin Roland describes Scapy-based multiplexing SMB and LDAP servers that simulate authenticated Active Directory services, enabling exploitation of user Group Policy Objects (via gPCFileSysPath/gPLink poisoning) without dummy domain controllers. It is offensive research with public tooling; no in-the-wild exploitation is reported.
On 2026-08-31 Synacktiv published offensive research by Quentin Roland on simulating legitimate Active Directory LDAP and SMB services on the network, building on the earlier GPOddity (gPCFileSysPath spoofing) and OUned (gPLink manipulation) tools. GPO poisoning works by modifying the gPCFileSysPath attribute of a Group Policy Container (GPC) LDAP object, or by injecting a malicious GPC reference through the gPLink attribute of an OU/site/domain (requiring WriteGPLink-type permissions), so that targets fetch a poisoned Group Policy Template (GPT) from an attacker-controlled SMB server. Malicious settings such as scheduled tasks (ScheduledTasks.xml) are then applied by the client with elevated privileges.
The research resolves a long-standing limitation around user GPOs. Since MS16-072 (CVE-2016-3223), the initial GPO retrieval uses the machine security context, and only the GPT.INI fetch uses the user's context. A rogue SMB server therefore needs to handle a user authentication followed by a second session (machine account) on the same TCP connection. The previous impacket-based SMB server assumed one session per connection and failed. Synacktiv implemented SMB session multiplexing (SessionID handling per SMB 2.0) in Scapy (SMBStreamSocketMultiplexing in layers/smb2.py, layers/smbserver.py), supporting Kerberos/Netlogon domain authentication.
The work also adds a Scapy-based LDAP server (layers/ldapserver.py, layers/ldap.py) configured from JSON keyed by distinguished names, supporting add/delete/modify/search (BASE/LEVEL/SUBTREE), SPNEGO authentication and a machine account (SCAPY$) with AES256 keys. This removes the need for a dummy Active Directory domain in OUned-style LDAP attacks and the tedious network forwarding previously required. The article notes the approach is also relevant to rogue LDAP/SMB listeners used in the Certighost ADCS flaw (CVE-2026-54121), mentioned only as context. The article states no IOCs, no detections or mitigations, and no in-the-wild use. Defenders should treat the published tooling as a source of behavioral detection opportunities: unexpected gPCFileSysPath/gPLink changes, GPC objects pointing to non-SYSVOL UNC paths, machine accounts fetching GPTs from non-domain-controller hosts, and rogue SMB/LDAP listeners on internal segments.
MITRE ATT&CK techniques used in TL-2026-4142
Defense Evasion
T1036 Masquerading; T1078.002 Domain Accounts
Execution
Persistence
Privilege Escalation
T1053.005 Scheduled Task; T1484.001 Group Policy Modification
Credential Access
T1187 Forced Authentication; T1557 Adversary-in-the-Middle
defense-impairment
T1484.001 Group Policy Modification
Collection
Affected products and versions in Simulating legitimate Active Directory services (SMB/LDAP)
- Microsoft — Active Directory Group Policy (domain-joined Windows clients)
Vulnerable versions: Environments where an attacker can write GPC gPCFileSysPath or OU/site/domain gPLink attributes
Fixed in: No product fix; mitigated by ACL hygiene, SMB/LDAP signing and monitoring
Remediation for Simulating legitimate Active Directory services (SMB/LDAP)
Patches
- Ensure MS16-072 (CVE-2016-3223) is applied on all Windows clients and servers
Immediate actions
- Audit write permissions (WriteGPLink, GPC attribute write) on GPOs, OUs, sites and domain objects and remove unnecessary delegations
- Alert on modifications of gPCFileSysPath and gPLink attributes (Event ID 5136) and on GPC objects whose path is not under the domain SYSVOL
Workarounds
- Restrict who can link GPOs and modify Group Policy Container objects to a minimal admin tier
Longer-term hardening
- Enforce SMB signing and LDAP signing/channel binding on domain controllers and clients
- Add OU/GPO ACL attack paths to BloodHound reviews and run regular GPO audits
- Segment networks to limit rogue SMB/LDAP listener placement and monitor for unexpected hosts serving SMB/LDAP
CVEs associated with Simulating legitimate Active Directory services (SMB/LDAP)
Timeline of Simulating legitimate Active Directory services (SMB/LDAP)
- Microsoft releases MS16-072 (CVE-2016-3223), changing user GPO retrieval so the initial GPO fetch uses the machine security context and only GPT.INI uses the user context.
- Synacktiv publishes GPOddity, a tool exploiting Active Directory GPOs via gPCFileSysPath spoofing in NTLM relaying contexts.
- Synacktiv publishes OUned (gPLink manipulation on OUs/containers); month stated as April 2024, exact day not given.
- Microsoft ships the fix for the Certighost AD CS flaw (CVE-2026-54121), which the article cites as another use case for simulated LDAP/SMB services.
- A working public exploit tool for Certighost (CVE-2026-54121) is released, per secondary reporting.
- Synacktiv publishes the research on simulating legitimate AD SMB/LDAP services using Scapy multiplexing SMB and LDAP servers for GPO exploitation.
Sources cited for Simulating legitimate Active Directory services (SMB/LDAP)
- Simulating legitimate Active Directory services on the network: the case of GPO exploitation (Synacktiv)
- GPOddity: exploiting Active Directory GPOs through NTLM relaying and more (Synacktiv)
- OUned.py: exploiting hidden Organizational Units ACL attack vectors in Active Directory (Synacktiv)
- GPOddity repository
- OUned repository
- GroupPolicyBackdoor repository
- Scapy repository
- Microsoft Security Bulletin MS16-072
- CVE-2026-54121: Certighost ADCS Flaw Lets Domain Users Impersonate Domain Controllers
- Certighost research (Kudelski Security)
Detection coverage for TL-2026-4142
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4142 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.