ADACL-016: Attack Path Enumeration
- Platform
- Active Directory
- Category
- AD ACL & Delegation
- Severity
- Critical
- Zero Trust pillar
- Identity (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Guerrilla loads the per-object ACL inventory collected by the rest of the ADACL family and joins it with group membership (member, memberOf, primaryGroupID), object ownership (nTSecurityDescriptor owner SID), AdminCount-flagged objects, GPO link relationships (gPLink), constrained and unconstrained delegation flags on userAccountControl and msDS-AllowedToActOnBehalfOfOtherIdentity, ADCS template enrollment ACLs, RBCD writeback rights (msDS-AllowedToActOnBehalfOfOtherIdentity), DCSync rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All control access rights on the domain head), and active sessions reported by NetWkstaUserEnum and NetSessionEnum where available. The resulting graph is the same node-and-edge model that BloodHound uses. The check then runs a shortest-path search from every node in Domain Users, Authenticated Users, and Everyone to every node in Domain Admins, Enterprise Admins, Schema Admins, Account Operators, Backup Operators, Print Operators, Server Operators, the Domain Controllers OU, and any object with adminCount=1. Each path is emitted with its edge sequence, hop count, and the weakest principal on the path.
Why it matters
Attack path analysis catches escalations that no single-control check can see. A helpdesk group with ForceChangePassword on a service account, plus that service account being a member of a custom application admin group, plus that group having WriteOwner on an OU that contains a tier one server, plus a Domain Admin session existing on that tier one server, is five benign-looking facts that together produce a one-shot path from any helpdesk operator to Domain Admins. Real-world breach data from Mandiant, Microsoft DART, and Secureworks consistently shows that the median enterprise has dozens of such paths and that attackers traverse them in hours, not days. The shortest path from Domain Users to Domain Admins is the single metric that best predicts blast radius after initial access. Paths shorter than five hops should be treated as imminent risk because they can be walked with no zero-days and no custom tooling.
Attack path
1. Attacker establishes a foothold as any domain user, typically through phishing or password spray. 2. Attacker runs SharpHound or AzureHound from the foothold host with default collection methods (ACL, Group, Session, LocalAdmin, Trusts, GPOLocalGroup, LoggedOn). Collection completes in minutes against a small estate and a few hours against a large one. 3. Attacker imports the SharpHound zip into BloodHound CE or BloodHound Enterprise and runs the prebuilt query "Shortest Paths to Domain Admins from Owned Principals" or the Cypher query MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN"})) RETURN p. 4. BloodHound returns one or more paths, each made of edges such as MemberOf, AdminTo, HasSession, ForceChangePassword, AddMember, GenericAll, GenericWrite, WriteDacl, WriteOwner, AllExtendedRights, GPLink, AddSelf, AllowedToDelegate, AllowedToAct, DCSync, SyncLAPSPassword, ReadLAPSPassword, ReadGMSAPassword, CanRDP, ExecuteDCOM, SQLAdmin, HasSIDHistory. 5. Attacker walks the path one edge at a time using the appropriate tradecraft for each edge: Rubeus or impacket for delegation edges, PowerView Set-DomainObject for ACL edges, Mimikatz or Rubeus for session theft, certipy for ADCS edges, gMSADumper for ReadGMSAPassword, secretsdump for DCSync. 6. Path terminates with the attacker holding credentials for an account in Domain Admins or with the ability to coerce a DC to authenticate, at which point the domain is fully compromised.
How Guerrilla assesses it
Guerrilla emits findings from the ADACL-001 through ADACL-015 checks into an in-memory adjacency list keyed on SID. Nodes are SIDs (resolved to sAMAccountName for display); edges carry a type (MemberOf, Owns, WriteDacl, WriteOwner, GenericAll, GenericWrite, ForceChangePassword, AddMember, AddSelf, AllExtendedRights, AllowedToDelegate, AllowedToAct, GetChanges, GetChangesAll, GPLink, CanRDP, HasSession, AdminTo, ReadLAPSPassword, ReadGMSAPassword, Enroll, AutoEnroll) and a confidence flag (explicit vs inherited, direct vs transitive group). Tier zero target sets are computed by reading the membership of the default protected groups (RID 512, 519, 518, 520, 548, 551, 550, 549) and the contents of the Domain Controllers OU plus any object with adminCount=1. The shortest-path search uses BFS from each non-tier-zero source set. For each path found, Guerrilla emits the full edge list, the hop count, and the principal at the start of the path. The data model is intentionally compatible with the BloodHound JSON schema (v6) so customers can re-ingest into BloodHound CE for visualization. Guerrilla does not collect sessions by default; session edges are included only if the customer enables the InvokeSessionEnumeration switch.
Recommended value
No viable attack paths from unprivileged users to Tier 0 assets; all identified paths remediated or documented as accepted risk
Remediation
Perform attack path analysis using tools such as BloodHound. Focus on shortest paths from Domain Users or Authenticated Users to Domain Admins, Enterprise Admins, and Domain Controllers. Break identified attack chains by removing the weakest link in each path. Prioritize paths that can be exploited without any special tools or elevated access.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6, RA-5, CA-8
- ANSSI
- vuln_attack_paths
- MITRE ATT&CK
- T1222.001, T1069.002, T1098