Use Case: Identity
Shadow admin discovery
A developer account had GenericAll rights on the Domain Admins group via three nested security groups. They didn't know it. The attacker found it in 8 minutes after compromising the account.
The admin rights that weren't in the report
BloodHound — the Active Directory attack path tool released in 2016 — revealed a systematic problem in enterprise environments: most organizations have dozens to hundreds of accounts with administrative capabilities through indirect permission chains that don't appear in any access review. A standard AD "show all domain admins" query returns the explicit members of the Domain Admins group. It doesn't show accounts that can add themselves to that group via WriteDACL or GenericAll rights on a parent group.
ManySignal performs the same graph traversal as BloodHound continuously — updated whenever a permission change occurs — providing a live map of all shadow admin paths in the environment.
detection: shadow_admin_graph_analysis
type: identity_graph_traversal
sources:
- active_directory_ldap
- microsoft_entra_id_graph
- okta_admin_api
- aws_iam_policy_simulator
process:
- traverse: all permission edges (membership, assignment, policy)
- calculate: effective_permissions(account) via all paths
- flag: accounts WHERE effective_admin_rights NOT IN explicit_admin_list
- delta_alert: new shadow admin path created (real-time)
enrichments:
- path_explanation: human_readable attack chain
- exploitability: path_length, compromise_complexity
- remediation: specific_permission_to_revoke
mitre: T1484 (Domain Policy Modification), T1078 (Valid Accounts)MITRE ATT&CK mapping
Shadow admin FAQ
What is a shadow admin and how does it arise?
A shadow admin is an account that has effective administrative capabilities through indirect permission paths — nested group memberships, transitive role assignments, or wildcard policy grants — without appearing in the explicit administrator list. They arise from accumulated permission grants over time, misconfigured nested groups, and IAM policies written with overly broad conditions.
How does ManySignal discover shadow admin paths?
ManySignal's identity graph performs a complete graph traversal of all permission relationships: group memberships, role assignments, policy attachments, and transitive trust relationships. For each account, it calculates the full set of effective permissions via all possible paths — revealing administrative capabilities that aren't visible in the direct assignment view.
What attack techniques exploit shadow admin paths?
An attacker who compromises a developer account with shadow admin access via a nested group can use the GenericAll or WriteDACL rights to grant themselves explicit admin. In Okta environments, a shadow admin via a group policy assignment can manage users, reset passwords, and modify MFA settings for the entire tenant.
Does ManySignal detect shadow admin abuse in progress, or just at discovery?
Both. The identity graph provides continuous shadow admin discovery — new paths created by permission changes are detected in real time. When an account with shadow admin capabilities performs administrative actions, the activity is correlated with the graph state and flagged as potentially unauthorized privilege use.
Find the admin paths that your access reviews miss
Continuous graph traversal across Active Directory, Entra ID, Okta, and AWS IAM — updated in real time.