AD Group Membership Abuse via Writable ACL

An operator with an authenticated Active Directory identity and network reachability to a domain controller may abuse an effective ACL that permits changing a group's member attribute (or an equivalent sufficient right) to add an existing user, group, or computer they control. This can maintain access or increase privileges according to the target group's permissions; it does not refresh tokens for existing logon sessions. The bloodyAD workflow requires LDAP/LDAPS connectivity to the domain controller. It can be used without an internal foothold only when an LDAP/LDAPS endpoint is intentionally reachable from the Internet, accepts the authentication method in use, and the caller's credentials and effective ACL permit the change; this is a deployment condition, not a claim that domain controllers are normally Internet-exposed. Use TLS for an Internet-reachable LDAP endpoint. Generic write, WriteDACL, or WriteOwner rights are not interchangeable with effective permission to modify the group's member attribute; inspect the exact rights on the specific group. This record covers group-membership changes, not password resets or DCSync credential extraction.