ADACL-010: Extended Rights Audit
- Platform
- Active Directory
- Category
- AD ACL & Delegation
- Severity
- Critical
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Guerrilla reads the nTSecurityDescriptor of the domain naming context root and other sensitive containers (Configuration, Schema, AdminSDHolder, privileged OUs) and parses the DACL for ACEs of type ACCESS_ALLOWED_OBJECT_ACE_TYPE (0x05) or ACCESS_ALLOWED_CALLBACK_OBJECT_ACE_TYPE (0x0B). For each object-type ACE, the ObjectType GUID is matched against the dangerous-extended-rights list: - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 DS-Replication-Get-Changes - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 DS-Replication-Get-Changes-All - 89e95b76-444d-4c62-991a-0facbeda640c DS-Replication-Get-Changes-In-Filtered-Set - 00299570-246d-11d0-a768-00aa006e0529 User-Force-Change-Password - 45ec5156-db7e-47bb-b53f-dbeb2d03c40f Reanimate-Tombstones - 1131f6ab-9c07-11d1-f79f-00c04fc2dcd2 DS-Replication-Synchronize Trustees on each matching ACE are resolved via the SID and compared against an allowlist of expected principals (Domain Controllers group, Enterprise Domain Controllers, Administrators, the built-in replication accounts, and explicitly approved synchronization service identities). Any other trustee is reported as a finding.
Why it matters
A single ACE granting DS-Replication-Get-Changes plus DS-Replication-Get-Changes-All on the domain object lets the trustee perform DCSync from any workstation: they can request replication of secret attributes (unicodePwd, ntPwdHistory, supplementalCredentials, pekList) for every account in the domain, including krbtgt. With the krbtgt hash an attacker forges Golden Tickets and persists indefinitely. User-Force-Change-Password grants the ability to reset any user password without knowing the current value, enabling targeted account takeover of Tier 0 identities without triggering password-change auditing on the trustee. Reanimate-Tombstones lets an attacker restore deleted privileged objects and inherit their group memberships. These rights are frequently granted by accident: legacy Azure AD Connect installers, third-party sync tools, IDM platforms, backup products, and helpdesk delegations have all been observed leaving DCSync-equivalent ACEs in place long after the product was decommissioned.
Attack path
1. Attacker compromises a low-privilege user that has been delegated an extended right on the domain object (often via group nesting). 2. Attacker enumerates ACLs using BloodHound or PowerView: Get-DomainObjectAcl -Identity "DC=corp,DC=local" -ResolveGUIDs | Where-Object ObjectAceType -match "Replication-Get-Changes". 3. If DS-Replication-Get-Changes and DS-Replication-Get-Changes-All are both present, attacker runs mimikatz lsadump::dcsync /domain:corp.local /user:krbtgt or secretsdump.py -just-dc corp/user@dc01 to extract the krbtgt hash. 4. With krbtgt, attacker forges a Golden Ticket (ticketer.py or Rubeus golden) granting arbitrary group membership, persisting through password resets. 5. Alternative path: a User-Force-Change-Password ACE on a Tier 0 OU lets the attacker reset a Domain Admin password directly via Set-DomainUserPassword, then authenticate interactively.
How Guerrilla assesses it
Guerrilla binds to the domain via LDAP, requests the nTSecurityDescriptor attribute with the DACL_SECURITY_INFORMATION control (LDAP_SERVER_SD_FLAGS_OID 1.2.840.113556.1.4.801, value 7), and parses each ACE in memory. Extended-rights GUIDs are resolved against the schema (CN=Extended-Rights,CN=Configuration). Trustee SIDs are translated to NT account names and compared against the built-in expected-trustee list. Findings include the object DN, ACE flags, ObjectType GUID, resolved right name, and trustee. The detection also correlates with Event ID 4662 (operation on an object) where the Properties field contains the extended-rights GUID, providing runtime evidence of abuse.
Recommended value
Extended rights limited to default and explicitly authorized principals; DCSync rights only on domain controllers
Remediation
Enumerate all extended rights ACEs on the domain root and critical objects. Verify that DS-Replication-Get-Changes and DS-Replication-Get-Changes-All are only granted to domain controllers and authorized replication accounts. Remove any non-default extended rights grants. Monitor Event ID 4662 for extended rights usage.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6, AC-6(5), AU-12
- ANSSI
- vuln_dcsync_rights
- MITRE ATT&CK
- T1003.006, T1098