ADACL-011: Propiedad de objetos críticos
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El propietario de un objeto de AD tiene permiso implícito para modificar la DACL del objeto, independientemente de las entradas explícitas de la ACL. Si objetos críticos como la raíz del dominio, AdminSDHolder, los grupos privilegiados o los GPO son propiedad de cuentas no privilegiadas o inesperadas, dichas cuentas disponen de una vía oculta hacia el control total
Por qué importa
Object ownership in Active Directory bypasses delegation entirely. The owner can always rewrite the DACL via WRITE_DAC, grant themselves GenericAll, and then perform whatever modification the object permits. There is no audit-by-default for ownership-derived access because the implicit rights do not appear in the explicit ACE list that most ACL auditors review. If the domain head is owned by a non-privileged account, that account can grant itself DS-Replication-Get-Changes and DS-Replication-Get-Changes-All, enabling DCSync. If AdminSDHolder is owned by a low-tier account, the SDProp process will propagate any malicious ACEs that account writes to every protected group hourly, creating a persistent backdoor. If a GPO is owned by a helpdesk account, that account can edit the GPO contents and push SYSTEM-level code to every machine in the linked scope. Ownership misconfigurations are a frequent finding after long-running domain migrations, third-party installer rollouts (some products take ownership of OUs they create), and helpdesk delegation drift.
Ruta de ataque
1. Reconnaissance: An attacker with a foothold in the domain enumerates owners with BloodHound (Owns edge) or PowerView (Get-DomainObjectAcl -ResolveGUIDs | Where-Object {$_.Owner}). 2. Target selection: BloodHound surfaces Owns edges from compromised principals to Tier 0 objects. Common targets are AdminSDHolder, Domain Admins, and GPOs linked to the Domain Controllers OU. 3. DACL rewrite: Using the owner identity, the attacker calls Set-DomainObjectOwner or Set-Acl to grant themselves GenericAll, WriteDacl, or specific extended rights such as DS-Replication-Get-Changes and DS-Replication-Get-Changes-All on the domain head. 4. Abuse: With DCSync rights, the attacker dumps krbtgt and every domain account hash using Mimikatz lsadump::dcsync or secretsdump.py. If the target was AdminSDHolder, the malicious ACE survives ACL reverts because SDProp re-applies AdminSDHolder's DACL to every protected group every 60 minutes. If the target was a GPO, the attacker edits GptTmpl.inf or Scripts.ini to drop a scheduled task that runs as SYSTEM on every endpoint receiving the policy. 5. Persistence: Ownership-based backdoors are particularly resilient because most ACL remediation tooling rewrites explicit ACEs but does not reset the Owner attribute.
Cómo lo evalúa Guerrilla
Guerrilla performs an LDAP search using the Get-ADObject cmdlet (or System.DirectoryServices for non-RSAT environments) requesting the nTSecurityDescriptor attribute with SACL access masked off. The owner is extracted via the SecurityDescriptor.Owner property on the resulting ActiveDirectorySecurity object, then translated from SID to NTAccount. The check iterates the target list described above, including dynamic enumeration of all gPLink-referenced GPOs and all members of the default AdminSDHolder-protected group list. Any owner SID outside the Tier 0 allowlist is emitted as a finding with the object DN, current owner, expected owner set, and the implicit rights the owner holds (WRITE_DAC, WRITE_OWNER, READ_CONTROL).
Valor recomendado
Objetos críticos propiedad únicamente de Domain Admins, Enterprise Admins o SYSTEM
Remediación
Enumere la propiedad de todos los objetos críticos, incluidos la raíz del dominio, AdminSDHolder, el contenedor Schema, el contenedor Configuration, los objetos de grupos privilegiados y los objetos GPO. Transfiera la propiedad de cualquier objeto con propietario incorrecto a Domain Admins con Set-Acl o la pestaña Seguridad en ADUC. Habilite la auditoría de cambios de propiedad.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-3
- ANSSI
- vuln_object_ownership
- MITRE ATT&CK
- T1222.001