ADACL-015: Shadow Admins Detection
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check walks every ACL-bearing object in the domain (users, groups, computers, OUs, the domain root, and AdminSDHolder) and reads nTSecurityDescriptor. For each DACL it enumerates ACEs that grant rights with privilege escalation semantics: WriteDacl (0x00040000), WriteOwner (0x00080000), GenericAll (0x000F01FF), GenericWrite (0x00020028), WriteProperty on member (bf9679c0-0de6-11d0-a285-00aa003049e2) which is Self/Add-Member, WriteProperty on servicePrincipalName which enables targeted Kerberoasting against a privileged account, ForceChangePassword extended right (00299570-246d-11d0-a768-00aa006e0529), AllExtendedRights (0x00000100) on AdminSDHolder, ReadProperty on msDS-ManagedPassword (gMSA password read), and Write on msDS-AllowedToActOnBehalfOfOfOtherIdentity (RBCD primitive). The set of nodes is then composed into a directed graph and traversed: any principal that can reach a member of Domain Admins, Enterprise Admins, Administrators, Schema Admins, or any AdminSDHolder-protected group in one or more hops is reported as a Shadow Admin, along with the full path and the rights consumed at each edge. The check also flags principals with non-zero adminCount that are no longer members of a protected group, because AdminSDHolder does not reverse its ACL stamp on removal and those orphans retain protected-equivalent ACLs.
Por qué importa
Group-membership monitoring is the most common privileged access control in Active Directory environments. PAM products, SIEM correlation rules, AD audit reports, and even Microsofts own Tier 0 documentation lean heavily on enumeration of Domain Admins, Enterprise Admins, and the AdminSDHolder-protected set. Shadow Admins sidestep all of this. An account with WriteDacl on the Domain Admins group, GenericAll on the AdminSDHolder container, AddMember on a tier zero nested group, ForceChangePassword on a Domain Admin, or msDS-AllowedToActOnBehalfOfOtherIdentity write on a DC has Domain Admin equivalent power, but a group membership report will never surface it. Attackers prefer Shadow Admin paths precisely because they bypass detection and because the ACL primitive that grants the path is typically the residue of a forgotten delegation: a contractor who once needed to reset DA passwords, a migration tool service account that was granted GenericAll years ago, a help desk role that was scoped too broadly. BloodHound was built around this exact problem and the Shortest Paths to Domain Admins query collapses to a Shadow Admin path in the majority of real environments. The blast radius is full forest compromise: any Shadow Admin path is, by definition, a one-step or few-step path to tier zero.
Ruta de ataque
Step 1: Initial foothold. The attacker compromises a low-privilege user or workstation through phishing, password spray, or exploitation. Step 2: Recon. The attacker runs SharpHound or AzureHound with the DCOnly or All collection method, ingests the data into BloodHound, marks the foothold principal as Owned, and runs the Shortest Paths to Domain Admins from Owned Principals query. The path returned is rarely group membership; it is typically a chain of ACL edges (WriteDacl on a group, GenericAll on a user, ForceChangePassword on a DA, AddMember to Domain Admins). Step 3: Edge abuse. The attacker executes the path with PowerView, Impacket, or the BloodHound built-in cypher hints. Examples: Add-DomainObjectAcl / Set-DomainObject for WriteDacl, Add-ADGroupMember for AddMember, Set-DomainUserPassword for ForceChangePassword, Set-ADComputer -PrincipalsAllowedToDelegateToAccount for RBCD against a DC. Step 4: Privilege materialization. The final hop puts the attacker either directly into Domain Admins (group write) or into a position where they can request a TGT for a DA (RBCD S4U2Self/S4U2Proxy via Rubeus, ForceChangePassword followed by logon, or DCSync rights granted to the foothold). Step 5: Persistence. The attacker often leaves the Shadow Admin path intact rather than promoting themselves into Domain Admins, because the path is invisible to membership monitoring and survives password resets. Sean Metcalf and SpecterOps both document this as the preferred adversary persistence pattern in mature environments.
Cómo lo evalúa Guerrilla
Guerrilla performs the check in three phases. Phase one (seed): it builds the tier zero target set, comprising members of Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Backup Operators, Print Operators, Server Operators, the krbtgt account, the AdminSDHolder container, every domain controller computer object, and any group nested inside the above. Phase two (edge collection): it queries every user, group, computer, and OU via System.DirectoryServices, reads nTSecurityDescriptor with SACL omitted, and emits an edge for each ACE that confers WriteDacl, WriteOwner, GenericAll, GenericWrite, WriteProperty (member, servicePrincipalName, msDS-AllowedToActOnBehalfOfOtherIdentity, msDS-KeyCredentialLink), AllExtendedRights, ForceChangePassword, or ReadProperty on msDS-ManagedPassword or ms-Mcs-AdmPwd. Phase three (traversal): a directed-graph BFS from every non-tier-zero principal to the tier zero seed set; any principal with a finite path is reported. The output includes the start principal, every intermediate node, the right consumed on each edge, whether the ACE is inherited or explicit, and the resolved object path. The check also independently enumerates objects with adminCount=1 whose distinguishedName is not currently in a protected group, since those are AdminSDHolder ghosts and frequently equate to a Shadow Admin condition.
Valor recomendado
No shadow admin paths identified; all admin-equivalent access is through explicit privileged group membership
Remediación
Use BloodHound or similar tools to identify ACL-based attack paths to Domain Admin-equivalent access. Remove unnecessary ACEs that create indirect privilege escalation paths. Ensure all administrative access is granted through protected group membership. Implement regular attack path analysis as part of security operations.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(5), AC-2(7)
- ANSSI
- vuln_shadow_admins
- MITRE ATT&CK
- T1222.001, T1098, T1069.002