Enum ControlPrimitive 

pub enum ControlPrimitive {
    Owns,
    WriteDacl,
    WriteOwner,
    GenericAll,
    GenericWrite,
    AllExtendedRights,
    ForceChangePassword,
    AddMember,
    AddSelfToGroup,
    AddKeyCredential,
    WriteRbcd,
    WriteSpn,
    WriteAltSecurityIdentities,
    WriteAllowedToDelegateTo,
    WriteGpLink,
    ReadGmsaPassword,
    ReadLapsPassword,
    DcsyncGetChanges,
    DcsyncGetChangesAll,
    DcsyncGetChangesFiltered,
    ReanimateTombstones,
    Enroll,
    CreateDmsa,
    CreateChild(Option<Guid>),
}

A concrete thing a trustee can do to an object, derived from one ACE.

Variants

Owns

Owner of the object — can rewrite its DACL at will.

WriteDacl

WRITE_DAC — can grant itself anything else.

WriteOwner

WRITE_OWNER — can take ownership, then rewrite the DACL.

GenericAll

GENERIC_ALL / full control.

GenericWrite

GENERIC_WRITE, or unscoped WRITE_PROP — can write every attribute.

AllExtendedRights

Unscoped CONTROL_ACCESS — holds every extended right, DCSync included.

ForceChangePassword

User-Force-Change-Password.

AddMember

Write member — add any principal to the group.

AddSelfToGroup

Validated write on member — add itself to the group.

AddKeyCredential

Write msDS-KeyCredentialLink — Shadow Credentials.

WriteRbcd

Write msDS-AllowedToActOnBehalfOfOtherIdentity — resource-based constrained delegation.

WriteSpn

Write servicePrincipalName — make the account Kerberoastable (targeted roasting).

WriteAltSecurityIdentities

Write altSecurityIdentities — bind an attacker certificate to the account.

WriteAllowedToDelegateTo

Write msDS-AllowedToDelegateTo — constrained delegation with protocol transition.

WriteGpLink

Write gPLink — attach a hostile GPO to the container.

ReadGmsaPassword

Read the gMSA managed-password blob — derive the account’s keys.

ReadLapsPassword

Read a LAPS password attribute — local administrator on that machine.

DcsyncGetChanges

DS-Replication-Get-Changes.

DcsyncGetChangesAll

DS-Replication-Get-Changes-All — the half that carries secrets.

DcsyncGetChangesFiltered

DS-Replication-Get-Changes-In-Filtered-Set.

ReanimateTombstones

Reanimate-Tombstones — resurrect deleted objects.

Enroll

Certificate-Enrollment / Certificate-AutoEnrollment on a template.

CreateDmsa

Create a delegated MSA under this container (BadSuccessor).

CreateChild(Option<Guid>)

CREATE_CHILD, optionally scoped to one object class GUID.

Implementations

impl ControlPrimitive

pub fn name(self) -> &'static str

Stable identifier, usable as a graph edge label.

pub fn cost(self) -> u32

Attacker cost of traversing this primitive. Lower = cheaper = more dangerous.

0 — already equivalent to control (no action needed). 1 — one write/read and the target is owned. 2 — needs a second step (a coerced auth, a TGT request, a roast). 3 — noisy or slow (offline cracking, waiting for a GPO refresh).

pub fn impact(self) -> &'static str

What the attacker gets out of it — the impact line of a report.

pub fn mitigation(self) -> &'static str

The defensive counterpart — the defence line of a report.

Trait Implementations

impl Clone for ControlPrimitive

fn clone(&self) -> ControlPrimitive

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ControlPrimitive

impl Debug for ControlPrimitive

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ControlPrimitive

impl Hash for ControlPrimitive

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for ControlPrimitive

fn eq(&self, other: &ControlPrimitive) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ControlPrimitive