ADACL-010: Auditoría de derechos extendidos
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Los derechos extendidos en Active Directory incluyen operaciones potentes como DS-Replication-Get-Changes (DCSync), User-Force-Change-Password y DS-Replication-Get-Changes-All. Las concesiones no autorizadas de estos derechos pueden conducir al compromiso total del dominio mediante robo de credenciales o apropiación directa de cuentas
Por qué importa
A single ACE granting DS-Replication-Get-Changes plus DS-Replication-Get-Changes-All on the domain object lets the trustee perform DCSync from any workstation: they can request replication of secret attributes (unicodePwd, ntPwdHistory, supplementalCredentials, pekList) for every account in the domain, including krbtgt. With the krbtgt hash an attacker forges Golden Tickets and persists indefinitely. User-Force-Change-Password grants the ability to reset any user password without knowing the current value, enabling targeted account takeover of Tier 0 identities without triggering password-change auditing on the trustee. Reanimate-Tombstones lets an attacker restore deleted privileged objects and inherit their group memberships. These rights are frequently granted by accident: legacy Azure AD Connect installers, third-party sync tools, IDM platforms, backup products, and helpdesk delegations have all been observed leaving DCSync-equivalent ACEs in place long after the product was decommissioned.
Ruta de ataque
1. Attacker compromises a low-privilege user that has been delegated an extended right on the domain object (often via group nesting). 2. Attacker enumerates ACLs using BloodHound or PowerView: Get-DomainObjectAcl -Identity "DC=corp,DC=local" -ResolveGUIDs | Where-Object ObjectAceType -match "Replication-Get-Changes". 3. If DS-Replication-Get-Changes and DS-Replication-Get-Changes-All are both present, attacker runs mimikatz lsadump::dcsync /domain:corp.local /user:krbtgt or secretsdump.py -just-dc corp/user@dc01 to extract the krbtgt hash. 4. With krbtgt, attacker forges a Golden Ticket (ticketer.py or Rubeus golden) granting arbitrary group membership, persisting through password resets. 5. Alternative path: a User-Force-Change-Password ACE on a Tier 0 OU lets the attacker reset a Domain Admin password directly via Set-DomainUserPassword, then authenticate interactively.
Cómo lo evalúa Guerrilla
Guerrilla binds to the domain via LDAP, requests the nTSecurityDescriptor attribute with the DACL_SECURITY_INFORMATION control (LDAP_SERVER_SD_FLAGS_OID 1.2.840.113556.1.4.801, value 7), and parses each ACE in memory. Extended-rights GUIDs are resolved against the schema (CN=Extended-Rights,CN=Configuration). Trustee SIDs are translated to NT account names and compared against the built-in expected-trustee list. Findings include the object DN, ACE flags, ObjectType GUID, resolved right name, and trustee. The detection also correlates with Event ID 4662 (operation on an object) where the Properties field contains the extended-rights GUID, providing runtime evidence of abuse.
Valor recomendado
Derechos extendidos limitados a principales predeterminados y explícitamente autorizados; derechos de DCSync únicamente en los controladores de dominio
Remediación
Enumere todas las ACE de derechos extendidos sobre la raíz del dominio y los objetos críticos. Verifique que DS-Replication-Get-Changes y DS-Replication-Get-Changes-All se concedan únicamente a los controladores de dominio y a las cuentas de replicación autorizadas. Elimine cualquier concesión de derechos extendidos no predeterminada. Supervise el Event ID 4662 para el uso de derechos extendidos.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(5), AU-12
- ANSSI
- vuln_dcsync_rights
- MITRE ATT&CK
- T1003.006, T1098