ADACL-011: Ownership of Critical Objects
- Platform
- Active Directory
- Category
- AD ACL & Delegation
- Severity
- High
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Guerrilla reads the nTSecurityDescriptor attribute on a defined set of critical objects and extracts the Owner SID from the security descriptor. Targets include: - The domain root object (the domain naming context head) - CN=AdminSDHolder,CN=System,DC=<domain> - The Configuration naming context (CN=Configuration,DC=<forest>) - The Schema naming context (CN=Schema,CN=Configuration,DC=<forest>) - Default protected group objects: Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Backup Operators, Server Operators, Print Operators, Domain Controllers, Read-Only Domain Controllers, Replicator, Cert Publishers, Key Admins, Enterprise Key Admins - All Group Policy Container objects under CN=Policies,CN=System - The Domain Controllers OU For each object, the resolved owner SID is compared against an allowlist of well-known Tier 0 principals: S-1-5-21-<domain>-512 (Domain Admins), S-1-5-21-<root>-519 (Enterprise Admins), S-1-5-32-544 (BUILTIN\Administrators), and S-1-5-18 (LOCAL SYSTEM). Any owner outside that allowlist produces a finding.
Why it matters
Object ownership in Active Directory bypasses delegation entirely. The owner can always rewrite the DACL via WRITE_DAC, grant themselves GenericAll, and then perform whatever modification the object permits. There is no audit-by-default for ownership-derived access because the implicit rights do not appear in the explicit ACE list that most ACL auditors review. If the domain head is owned by a non-privileged account, that account can grant itself DS-Replication-Get-Changes and DS-Replication-Get-Changes-All, enabling DCSync. If AdminSDHolder is owned by a low-tier account, the SDProp process will propagate any malicious ACEs that account writes to every protected group hourly, creating a persistent backdoor. If a GPO is owned by a helpdesk account, that account can edit the GPO contents and push SYSTEM-level code to every machine in the linked scope. Ownership misconfigurations are a frequent finding after long-running domain migrations, third-party installer rollouts (some products take ownership of OUs they create), and helpdesk delegation drift.
Attack path
1. Reconnaissance: An attacker with a foothold in the domain enumerates owners with BloodHound (Owns edge) or PowerView (Get-DomainObjectAcl -ResolveGUIDs | Where-Object {$_.Owner}). 2. Target selection: BloodHound surfaces Owns edges from compromised principals to Tier 0 objects. Common targets are AdminSDHolder, Domain Admins, and GPOs linked to the Domain Controllers OU. 3. DACL rewrite: Using the owner identity, the attacker calls Set-DomainObjectOwner or Set-Acl to grant themselves GenericAll, WriteDacl, or specific extended rights such as DS-Replication-Get-Changes and DS-Replication-Get-Changes-All on the domain head. 4. Abuse: With DCSync rights, the attacker dumps krbtgt and every domain account hash using Mimikatz lsadump::dcsync or secretsdump.py. If the target was AdminSDHolder, the malicious ACE survives ACL reverts because SDProp re-applies AdminSDHolder's DACL to every protected group every 60 minutes. If the target was a GPO, the attacker edits GptTmpl.inf or Scripts.ini to drop a scheduled task that runs as SYSTEM on every endpoint receiving the policy. 5. Persistence: Ownership-based backdoors are particularly resilient because most ACL remediation tooling rewrites explicit ACEs but does not reset the Owner attribute.
How Guerrilla assesses it
Guerrilla performs an LDAP search using the Get-ADObject cmdlet (or System.DirectoryServices for non-RSAT environments) requesting the nTSecurityDescriptor attribute with SACL access masked off. The owner is extracted via the SecurityDescriptor.Owner property on the resulting ActiveDirectorySecurity object, then translated from SID to NTAccount. The check iterates the target list described above, including dynamic enumeration of all gPLink-referenced GPOs and all members of the default AdminSDHolder-protected group list. Any owner SID outside the Tier 0 allowlist is emitted as a finding with the object DN, current owner, expected owner set, and the implicit rights the owner holds (WRITE_DAC, WRITE_OWNER, READ_CONTROL).
Recommended value
Critical objects owned by Domain Admins, Enterprise Admins, or SYSTEM only
Remediation
Enumerate ownership of all critical objects including the domain root, AdminSDHolder, Schema container, Configuration container, privileged group objects, and GPO objects. Transfer ownership of any incorrectly owned objects to Domain Admins using Set-Acl or the Security tab in ADUC. Enable auditing for ownership changes.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6, AC-3
- ANSSI
- vuln_object_ownership
- MITRE ATT&CK
- T1222.001