ADACL-011: Ownership of Critical Objects
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla reads the nTSecurityDescriptor attribute on a defined set of critical objects and extracts the Owner SID from the security descriptor. Targets include: - The domain root object (the domain naming context head) - CN=AdminSDHolder,CN=System,DC=<domain> - The Configuration naming context (CN=Configuration,DC=<forest>) - The Schema naming context (CN=Schema,CN=Configuration,DC=<forest>) - Default protected group objects: Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Backup Operators, Server Operators, Print Operators, Domain Controllers, Read-Only Domain Controllers, Replicator, Cert Publishers, Key Admins, Enterprise Key Admins - All Group Policy Container objects under CN=Policies,CN=System - The Domain Controllers OU For each object, the resolved owner SID is compared against an allowlist of well-known Tier 0 principals: S-1-5-21-<domain>-512 (Domain Admins), S-1-5-21-<root>-519 (Enterprise Admins), S-1-5-32-544 (BUILTIN\Administrators), and S-1-5-18 (LOCAL SYSTEM). Any owner outside that allowlist produces a finding.
Por qué importa
Object ownership in Active Directory bypasses delegation entirely. The owner can always rewrite the DACL via WRITE_DAC, grant themselves GenericAll, and then perform whatever modification the object permits. There is no audit-by-default for ownership-derived access because the implicit rights do not appear in the explicit ACE list that most ACL auditors review. If the domain head is owned by a non-privileged account, that account can grant itself DS-Replication-Get-Changes and DS-Replication-Get-Changes-All, enabling DCSync. If AdminSDHolder is owned by a low-tier account, the SDProp process will propagate any malicious ACEs that account writes to every protected group hourly, creating a persistent backdoor. If a GPO is owned by a helpdesk account, that account can edit the GPO contents and push SYSTEM-level code to every machine in the linked scope. Ownership misconfigurations are a frequent finding after long-running domain migrations, third-party installer rollouts (some products take ownership of OUs they create), and helpdesk delegation drift.
Ruta de ataque
1. Reconnaissance: An attacker with a foothold in the domain enumerates owners with BloodHound (Owns edge) or PowerView (Get-DomainObjectAcl -ResolveGUIDs | Where-Object {$_.Owner}). 2. Target selection: BloodHound surfaces Owns edges from compromised principals to Tier 0 objects. Common targets are AdminSDHolder, Domain Admins, and GPOs linked to the Domain Controllers OU. 3. DACL rewrite: Using the owner identity, the attacker calls Set-DomainObjectOwner or Set-Acl to grant themselves GenericAll, WriteDacl, or specific extended rights such as DS-Replication-Get-Changes and DS-Replication-Get-Changes-All on the domain head. 4. Abuse: With DCSync rights, the attacker dumps krbtgt and every domain account hash using Mimikatz lsadump::dcsync or secretsdump.py. If the target was AdminSDHolder, the malicious ACE survives ACL reverts because SDProp re-applies AdminSDHolder's DACL to every protected group every 60 minutes. If the target was a GPO, the attacker edits GptTmpl.inf or Scripts.ini to drop a scheduled task that runs as SYSTEM on every endpoint receiving the policy. 5. Persistence: Ownership-based backdoors are particularly resilient because most ACL remediation tooling rewrites explicit ACEs but does not reset the Owner attribute.
Cómo lo evalúa Guerrilla
Guerrilla performs an LDAP search using the Get-ADObject cmdlet (or System.DirectoryServices for non-RSAT environments) requesting the nTSecurityDescriptor attribute with SACL access masked off. The owner is extracted via the SecurityDescriptor.Owner property on the resulting ActiveDirectorySecurity object, then translated from SID to NTAccount. The check iterates the target list described above, including dynamic enumeration of all gPLink-referenced GPOs and all members of the default AdminSDHolder-protected group list. Any owner SID outside the Tier 0 allowlist is emitted as a finding with the object DN, current owner, expected owner set, and the implicit rights the owner holds (WRITE_DAC, WRITE_OWNER, READ_CONTROL).
Valor recomendado
Critical objects owned by Domain Admins, Enterprise Admins, or SYSTEM only
Remediación
Enumerate ownership of all critical objects including the domain root, AdminSDHolder, Schema container, Configuration container, privileged group objects, and GPO objects. Transfer ownership of any incorrectly owned objects to Domain Admins using Set-Acl or the Security tab in ADUC. Enable auditing for ownership changes.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-3
- ANSSI
- vuln_object_ownership
- MITRE ATT&CK
- T1222.001