ADDOM-010: Sites and Subnets Configuration
- Platform
- Active Directory
- Category
- AD Domain & Forest Configuration
- Severity
- Medium
- Zero Trust pillar
- Governance (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Guerrilla enumerates every site object under CN=Sites,CN=Configuration,DC=<forest> and every subnet object under CN=Subnets,CN=Sites,CN=Configuration,DC=<forest>. For each subnet it reads the cn (the CIDR string, for example 10.20.0.0/22), the siteObject linked attribute that ties it to a site, and the location attribute. It then pulls the Netlogon NO_CLIENT_SITE events (Event ID 5807) and the DC Netlogon.log file from each DC computer object reachable via SMB to identify source IPs that authenticated without matching a defined subnet. The check fails when the count of distinct source subnets observed in NO_CLIENT_SITE events exceeds zero, or when any defined subnet object has no siteObject value, or when a site exists with zero linked subnets and at least one DC (an orphan DC).
Why it matters
Site and subnet topology is a security control, not just a performance control. The DC Locator process (DsGetDcName) returns the closest DC to the client based on the subnet-to-site mapping. When the mapping is missing the client picks a DC at random from the forest, which has four concrete consequences. First, authentication traffic crosses WAN links that were never approved as authentication paths, which violates network segmentation assumptions and may expose Kerberos PreAuth data and LDAP simple binds to network segments where capture is easier. Second, GPO download (\\domain\SYSVOL) goes to a random DC, which means a tampered SYSVOL on one DC propagates to clients the operator did not expect. Third, an attacker on an unmapped guest VLAN, lab subnet, or rogue VPN pool can deliberately authenticate to whichever DC they want, which is the precondition for NTLM relay against a chosen ADCS HTTP endpoint (PetitPotam, CVE-2021-36942) and for targeting a specific DC for coercion. Fourth, NO_CLIENT_SITE flooding hides real anomalies in the Netlogon log, so a defender loses one of the cheapest detection signals for rogue subnets and rogue DC enumeration.
Attack path
An attacker with a foothold on an unmapped subnet (a contractor VLAN, a lab network, an OT segment, or a VPN pool that was added without updating Sites and Services) enumerates DCs with nltest /dclist:<domain> or nslookup -type=SRV _ldap._tcp.dc._msdcs.<domain> and receives the full list of DCs across every site. The attacker then chooses the DC they want, typically the one in the site that hosts the ADCS Web Enrollment role, and triggers a coercion primitive (PetitPotam, PrinterBug, DFSCoerce) that forces a target machine account to authenticate to the attacker. Because the attacker controls which DC the coerced authentication targets, they can chain into NTLM relay against AD CS HTTP endpoints (ESC8) and obtain a certificate for the DC machine account, leading to full domain compromise. Tools observed in the wild: ntlmrelayx.py from impacket, PetitPotam.py, Certipy relay, and dfscoerce.py. The site-and-subnet gap does not create the vulnerability on its own, it removes a defender control (steering authentication to a known, monitored DC) that would otherwise reduce the attack surface.
How Guerrilla assesses it
The check executes an LDAP search against CN=Subnets,CN=Sites,CN=Configuration,DC=<forest> with filter (objectClass=subnet) and reads cn, siteObject, and location. It then issues a second search against CN=Sites,CN=Configuration,DC=<forest> with filter (objectClass=site), expands the siteObjectBL backlink on each site, and counts the linked subnets. Guerrilla also reads Event ID 5807 from the System log on each reachable DC (Source: NETLOGON, "During the past N hours there have been M connections to this Domain Controller from client machines whose IP addresses don't map to any of the existing sites in the enterprise") and parses %SystemRoot%\debug\netlogon.log for NO_CLIENT_SITE lines. The combined output lists three failure modes: (a) defined subnets with no site, (b) sites with no subnet but with a DC, (c) live client IPs that match no defined subnet.
Recommended value
All IP subnets mapped to appropriate AD sites with no orphaned subnets
Remediation
Review AD Sites and Services > Subnets container. Cross-reference with network documentation to identify unmapped subnets. Create subnet objects for all production networks and associate them with the correct site
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- SC-7, CM-6
- CIS AD Benchmark
- 1.5.1
- MITRE ATT&CK
- T1557