ADACL-015: Detección de administradores en la sombra
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Los administradores en la sombra son cuentas que disponen de vías indirectas hacia un acceso equivalente al de Domain Admin a través de cadenas de ACL, pero que no son miembros de ningún grupo privilegiado. Estas cuentas eluden la protección de AdminSDHolder y la supervisión tradicional de acceso privilegiado. Por ejemplo, una cuenta con WriteDACL sobre el grupo Domain Admins puede concederse la pertenencia sin ser detectada por la supervisión de pertenencia a grupos
Por qué importa
Group-membership monitoring is the most common privileged access control in Active Directory environments. PAM products, SIEM correlation rules, AD audit reports, and even Microsofts own Tier 0 documentation lean heavily on enumeration of Domain Admins, Enterprise Admins, and the AdminSDHolder-protected set. Shadow Admins sidestep all of this. An account with WriteDacl on the Domain Admins group, GenericAll on the AdminSDHolder container, AddMember on a tier zero nested group, ForceChangePassword on a Domain Admin, or msDS-AllowedToActOnBehalfOfOtherIdentity write on a DC has Domain Admin equivalent power, but a group membership report will never surface it. Attackers prefer Shadow Admin paths precisely because they bypass detection and because the ACL primitive that grants the path is typically the residue of a forgotten delegation: a contractor who once needed to reset DA passwords, a migration tool service account that was granted GenericAll years ago, a help desk role that was scoped too broadly. BloodHound was built around this exact problem and the Shortest Paths to Domain Admins query collapses to a Shadow Admin path in the majority of real environments. The blast radius is full forest compromise: any Shadow Admin path is, by definition, a one-step or few-step path to tier zero.
Ruta de ataque
Step 1: Initial foothold. The attacker compromises a low-privilege user or workstation through phishing, password spray, or exploitation. Step 2: Recon. The attacker runs SharpHound or AzureHound with the DCOnly or All collection method, ingests the data into BloodHound, marks the foothold principal as Owned, and runs the Shortest Paths to Domain Admins from Owned Principals query. The path returned is rarely group membership; it is typically a chain of ACL edges (WriteDacl on a group, GenericAll on a user, ForceChangePassword on a DA, AddMember to Domain Admins). Step 3: Edge abuse. The attacker executes the path with PowerView, Impacket, or the BloodHound built-in cypher hints. Examples: Add-DomainObjectAcl / Set-DomainObject for WriteDacl, Add-ADGroupMember for AddMember, Set-DomainUserPassword for ForceChangePassword, Set-ADComputer -PrincipalsAllowedToDelegateToAccount for RBCD against a DC. Step 4: Privilege materialization. The final hop puts the attacker either directly into Domain Admins (group write) or into a position where they can request a TGT for a DA (RBCD S4U2Self/S4U2Proxy via Rubeus, ForceChangePassword followed by logon, or DCSync rights granted to the foothold). Step 5: Persistence. The attacker often leaves the Shadow Admin path intact rather than promoting themselves into Domain Admins, because the path is invisible to membership monitoring and survives password resets. Sean Metcalf and SpecterOps both document this as the preferred adversary persistence pattern in mature environments.
Cómo lo evalúa Guerrilla
Guerrilla performs the check in three phases. Phase one (seed): it builds the tier zero target set, comprising members of Domain Admins, Enterprise Admins, Schema Admins, Administrators, Account Operators, Backup Operators, Print Operators, Server Operators, the krbtgt account, the AdminSDHolder container, every domain controller computer object, and any group nested inside the above. Phase two (edge collection): it queries every user, group, computer, and OU via System.DirectoryServices, reads nTSecurityDescriptor with SACL omitted, and emits an edge for each ACE that confers WriteDacl, WriteOwner, GenericAll, GenericWrite, WriteProperty (member, servicePrincipalName, msDS-AllowedToActOnBehalfOfOtherIdentity, msDS-KeyCredentialLink), AllExtendedRights, ForceChangePassword, or ReadProperty on msDS-ManagedPassword or ms-Mcs-AdmPwd. Phase three (traversal): a directed-graph BFS from every non-tier-zero principal to the tier zero seed set; any principal with a finite path is reported. The output includes the start principal, every intermediate node, the right consumed on each edge, whether the ACE is inherited or explicit, and the resolved object path. The check also independently enumerates objects with adminCount=1 whose distinguishedName is not currently in a protected group, since those are AdminSDHolder ghosts and frequently equate to a Shadow Admin condition.
Valor recomendado
Ninguna vía de administrador en la sombra identificada; todo acceso equivalente al de administrador se realiza mediante pertenencia explícita a grupos privilegiados
Remediación
Utilice BloodHound o herramientas similares para identificar las vías de ataque basadas en ACL hacia un acceso equivalente al de Domain Admin. Elimine las ACE innecesarias que creen vías indirectas de escalada de privilegios. Asegúrese de que todo el acceso administrativo se conceda mediante la pertenencia a grupos protegidos. Implemente el análisis periódico de vías de ataque como parte de las operaciones de seguridad.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-6(5), AC-2(7)
- ANSSI
- vuln_shadow_admins
- MITRE ATT&CK
- T1222.001, T1098, T1069.002