Custom Active Directory Extensions Create Stealthy Backdoors for Corporate Attacks

Active Directory (AD) Group Policy Objects (GPOs) are a cornerstone of centralized management for Windows environments, enabling administrators to configure operating systems, applications, and user settings across all domain-connected machines.

The real work of applying these policies on client machines is handled by Client-Side Extensions (CSEs)—specialized dynamic link libraries (DLLs) that interpret and enforce GPO settings.

Each CSE is uniquely identified by a Globally Unique Identifier (GUID) and registered in the Windows Registry under:

- Advertisement -

textHKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions

Administrators and attackers alike can enumerate CSEs using PowerShell:

powershellGet-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions" | 
    Select-Object @{Name='GUID';Expression={$_.PSChildName}}, @{Name='Name';Expression={$_.GetValue('')}}

The proper application of a GPO depends on the presence and correct registration of the CSE both on the client and within the GPO’s attributes (gPCMachineExtensionNames or gPCUserExtensionNames).

If ...