Custom Active Directory Client-Side Extensions Enable Stealthy Corporate Backdoors

A sophisticated method for establishing persistent backdoors in corporate networks through the abuse of custom Client-Side Extensions (CSEs) in Microsoft Active Directory environments.

This technique leverages trusted Windows components to evade detection while providing attackers with privileged system access across entire domains.

The attack vector exploits Group Policy Objects (GPOs), a core feature of Active Directory that enables administrators to centrally manage and configure operating systems, applications, and user settings across all computers in a domain.

While traditional GPO abuse techniques are well-documented and monitored by security teams, this new approach involves creating entirely custom malicious CSEs that are significantly harder for defenders to identify than legitimate built-in CSEs used in malicious contexts, Tenable said.

Active Directory Client-Side Extensions Backdoor

CSEs are critical components that enable GPOs to apply specific settings such as software installation, registry edits, folder redirection, and scheduled tasks to client machines.

Each CSE is essentially a dynamic link library (DLL) file on the client Windows machine responsible for processing a particular type of Group Policy setting.

The successful application of settings relies on both the CSE being installed and registered on the client machine and the CSE’s GUID being listed in the GPO’s attributes.

The attack begins with creating a custom CSE DLL with an inconspicuous filename like “advshcore.dll” designed to appear legitimate in the Windows System32 folder.

Tenable researchers demonstrated this technique using Visual Studio to create a DLL project called “RogueCSE” with the deceptive, friendly name “Group Policy Shell Configuration”.

The malicious CSE implements Microsoft’s ProcessGroupPolicy function, which executes with highly privileged SYSTEM permissions during each Group Policy refresh cycle.

In the proof-of-concept demonstration, the custom code simply logged execution details to verify system access, but researchers warn that attackers could substitute malicious code for reverse shells, command-and-control agents, or sensitive data exfiltration.

For widespread deployment, attackers with domain privileges can place the DLL in SYSVOL locations, making it accessible to the domain.

The technique offers multiple deployment strategies: a reliable but more detectable approach using Files Group Policy Preference to copy the CSE locally, or a stealthier method hosting the DLL on network shares and loading it via registered network paths.

The persistence mechanism operates by adding the custom CSE’s GUID to the gPCMachineExtensionNames attribute of target GPOs. Once configured, the malicious code executes automatically during Group Policy refresh cycles – approximately every five minutes on domain controllers and every 90 minutes on member machines.

This technique poses significant detection challenges because it leverages native OS features instead of external malicious tools, making it difficult to identify through forensic analysis or threat identification.

Traditional security measures often focus on well-known abused CSEs like Scheduled Tasks or Startup Scripts, but custom CSEs can bypass these common alerts.

Security teams can monitor for this threat by analyzing Windows Event Logs for Security Event ID 5145 (write access to SYSVOL share), Event ID 4688 (new process creation), and Event ID 5136 (directory object modifications).

Organizations should also regularly audit CSE registrations and monitor changes to gPCMachineExtensionNames attributes in their Group Policy infrastructure.

The research underscores the critical importance of implementing rigorous monitoring for CSE registrations and GPO modifications in Active Directory environments to prevent these sophisticated persistence mechanisms.

Speed up and enrich threat investigations with Threat Intelligence Lookup! -> 50 trial search requests