ADACL-007: Excessive Delegation to Broad Groups
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check enumerates the discretionary access control list (nTSecurityDescriptor) on objects across the directory and inspects each access control entry (ACE) for two conditions in combination: (1) the trustee SID resolves to a broad, well-known group such as S-1-5-11 (Authenticated Users), S-1-1-0 (Everyone), the Domain Users group of any domain in the forest, or Domain Computers; and (2) the ActiveDirectoryRights mask grants a sensitive permission such as GenericAll, GenericWrite, WriteDacl, WriteOwner, WriteProperty on a sensitive attribute (member, servicePrincipalName, msDS-KeyCredentialLink, scriptPath, gPLink), or one of the dangerous extended rights (User-Force-Change-Password, DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, Self-Membership). Targets evaluated include the domain root, OUs, group objects (especially privileged groups), user objects, computer objects, GPO containers, the AdminSDHolder container, and the Configuration partition.
Por qué importa
A delegated right granted to Authenticated Users is, by definition, exercisable by every user, service account, and computer account in the forest and across every trusting forest. There is no compromise required to abuse it beyond holding any valid Kerberos or NTLM credential. This converts every phished mailbox, every cracked service account, and every laptop NTDS handle into a viable privilege escalation path. The blast radius is the scope of the object the ACE sits on: an ACE on the domain head with WriteDacl yields DCSync; an ACE on a Tier 0 group with WriteProperty on member yields group hijack; an ACE on a user with GenericWrite yields shadow credential or RBCD takeover. Because the principal is a default group, the misconfiguration is invisible to most native tooling and rarely surfaces in change reviews.
Ruta de ataque
1. Adversary obtains any low-privilege domain credential (phishing, password spray, NTLM coercion against a workstation). 2. From any domain-joined host, the adversary runs SharpHound or BloodHound.py with the default collection set; the collector enumerates ACLs as Authenticated Users and ingests every ACE granted to broad principals. 3. BloodHound surfaces the shortest path from the owned principal to Domain Admins or another Tier 0 target, where one or more edges are GenericAll, GenericWrite, WriteDacl, AddMember, ForceChangePassword, AddKeyCredentialLink, or GenericAll on a GPO. 4. The adversary executes the specific ACE abuse: Set-DomainObject for attribute writes, Add-DomainGroupMember for group hijack, Set-DomainUserPassword for forced reset, Whisker or pyWhisker for msDS-KeyCredentialLink shadow credentials, or PowerView Set-DomainObjectOwner followed by Add-DomainObjectAcl for WriteOwner chains. 5. With group membership or credential material on a Tier 0 principal, the adversary performs DCSync via mimikatz lsadump::dcsync or impacket secretsdump and harvests krbtgt for forest persistence.
Cómo lo evalúa Guerrilla
Guerrilla binds to each in-scope object and reads the nTSecurityDescriptor attribute through the AD provider, then walks the DACL ACE-by-ACE. For each ACE it resolves the IdentityReference to a SID, compares against a curated list of broad well-known SIDs (S-1-1-0, S-1-5-11, S-1-5-32-545, plus Domain Users and Domain Computers RIDs 513 and 515 in every domain SID in the forest), and tests the ActiveDirectoryRights value against a mask of sensitive rights (GenericAll, GenericWrite, WriteDacl, WriteOwner, WriteProperty, ExtendedRight, Self). For WriteProperty and ExtendedRight ACEs the ObjectType GUID is resolved against the schema to determine whether the controlled attribute or extended right is sensitive. Findings are emitted per ACE with the target object DN, trustee SID, rights mask, and inheritance flag so an analyst can correlate to the abuse primitive.
Valor recomendado
No sensitive permissions delegated to Authenticated Users, Domain Users, Everyone, or other broad groups
Remediación
Audit all ACLs for ACEs granted to well-known broad groups (S-1-5-11 Authenticated Users, Domain Users, Everyone, Domain Computers). Replace broad-group delegations with specific security groups containing only the required principals. Apply delegations at the narrowest OU scope possible.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(1), AC-3(7)
- ANSSI
- vuln_delegation_broad_groups
- MITRE ATT&CK
- T1222.001, T1069.002