dont mark Group Policy Creator owners as high value

dirkjanm · Jul 26, 2024 · 65c0fca · 65c0fca
1 parent 15d4697
commit 65c0fca
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/bloodhound/enumeration/memberships.py b/bloodhound/enumeration/memberships.py
@@ -246,7 +246,7 @@ def enumerate_groups(self, timestamp="", fileNamePrefix=""):
         highvalue = ["S-1-5-32-544", "S-1-5-32-550", "S-1-5-32-549", "S-1-5-32-551", "S-1-5-32-548"]
 
         def is_highvalue(sid):
-            if sid.endswith("-512") or sid.endswith("-516") or sid.endswith("-519") or sid.endswith("-520"):
+            if sid.endswith("-512") or sid.endswith("-516") or sid.endswith("-519"):
                 return True
             if sid in highvalue:
                 return True