ADACL-007: Delegación excesiva a grupos amplios
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La delegación de permisos sensibles a grupos amplios como Authenticated Users, Domain Users o Everyone crea una amplia superficie de ataque en la que cualquier cuenta comprometida puede abusar de los derechos delegados. Esta es una configuración incorrecta común que reduce drásticamente el esfuerzo necesario para la escalada de privilegios
Por qué importa
A delegated right granted to Authenticated Users is, by definition, exercisable by every user, service account, and computer account in the forest and across every trusting forest. There is no compromise required to abuse it beyond holding any valid Kerberos or NTLM credential. This converts every phished mailbox, every cracked service account, and every laptop NTDS handle into a viable privilege escalation path. The blast radius is the scope of the object the ACE sits on: an ACE on the domain head with WriteDacl yields DCSync; an ACE on a Tier 0 group with WriteProperty on member yields group hijack; an ACE on a user with GenericWrite yields shadow credential or RBCD takeover. Because the principal is a default group, the misconfiguration is invisible to most native tooling and rarely surfaces in change reviews.
Ruta de ataque
1. Adversary obtains any low-privilege domain credential (phishing, password spray, NTLM coercion against a workstation). 2. From any domain-joined host, the adversary runs SharpHound or BloodHound.py with the default collection set; the collector enumerates ACLs as Authenticated Users and ingests every ACE granted to broad principals. 3. BloodHound surfaces the shortest path from the owned principal to Domain Admins or another Tier 0 target, where one or more edges are GenericAll, GenericWrite, WriteDacl, AddMember, ForceChangePassword, AddKeyCredentialLink, or GenericAll on a GPO. 4. The adversary executes the specific ACE abuse: Set-DomainObject for attribute writes, Add-DomainGroupMember for group hijack, Set-DomainUserPassword for forced reset, Whisker or pyWhisker for msDS-KeyCredentialLink shadow credentials, or PowerView Set-DomainObjectOwner followed by Add-DomainObjectAcl for WriteOwner chains. 5. With group membership or credential material on a Tier 0 principal, the adversary performs DCSync via mimikatz lsadump::dcsync or impacket secretsdump and harvests krbtgt for forest persistence.
Cómo lo evalúa Guerrilla
Guerrilla binds to each in-scope object and reads the nTSecurityDescriptor attribute through the AD provider, then walks the DACL ACE-by-ACE. For each ACE it resolves the IdentityReference to a SID, compares against a curated list of broad well-known SIDs (S-1-1-0, S-1-5-11, S-1-5-32-545, plus Domain Users and Domain Computers RIDs 513 and 515 in every domain SID in the forest), and tests the ActiveDirectoryRights value against a mask of sensitive rights (GenericAll, GenericWrite, WriteDacl, WriteOwner, WriteProperty, ExtendedRight, Self). For WriteProperty and ExtendedRight ACEs the ObjectType GUID is resolved against the schema to determine whether the controlled attribute or extended right is sensitive. Findings are emitted per ACE with the target object DN, trustee SID, rights mask, and inheritance flag so an analyst can correlate to the abuse primitive.
Valor recomendado
Ningún permiso sensible delegado a Authenticated Users, Domain Users, Everyone u otros grupos amplios
Remediación
Audite todas las ACL en busca de ACE concedidas a grupos amplios bien conocidos (S-1-5-11 Authenticated Users, Domain Users, Everyone, Domain Computers). Sustituya las delegaciones a grupos amplios por grupos de seguridad específicos que contengan únicamente los principales requeridos. Aplique las delegaciones en el ámbito de OU más reducido posible.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(1), AC-3(7)
- ANSSI
- vuln_delegation_broad_groups
- MITRE ATT&CK
- T1222.001, T1069.002