ADACL-016: Enumeración de vías de ataque
- Plataforma
- Active Directory
- Categoría
- AD ACL & Delegation
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las vías de ataque de Active Directory son cadenas de permisos, pertenencias a grupos y relaciones de confianza que pueden recorrerse para escalar desde una cuenta de bajo privilegio hasta administrador de dominio. La enumeración exhaustiva de vías de ataque identifica riesgos que las comprobaciones individuales de ACL pueden pasar por alto, como las cadenas de escalada de varios saltos a través de objetos intermedios
Por qué importa
Attack path analysis catches escalations that no single-control check can see. A helpdesk group with ForceChangePassword on a service account, plus that service account being a member of a custom application admin group, plus that group having WriteOwner on an OU that contains a tier one server, plus a Domain Admin session existing on that tier one server, is five benign-looking facts that together produce a one-shot path from any helpdesk operator to Domain Admins. Real-world breach data from Mandiant, Microsoft DART, and Secureworks consistently shows that the median enterprise has dozens of such paths and that attackers traverse them in hours, not days. The shortest path from Domain Users to Domain Admins is the single metric that best predicts blast radius after initial access. Paths shorter than five hops should be treated as imminent risk because they can be walked with no zero-days and no custom tooling.
Ruta de ataque
1. Attacker establishes a foothold as any domain user, typically through phishing or password spray. 2. Attacker runs SharpHound or AzureHound from the foothold host with default collection methods (ACL, Group, Session, LocalAdmin, Trusts, GPOLocalGroup, LoggedOn). Collection completes in minutes against a small estate and a few hours against a large one. 3. Attacker imports the SharpHound zip into BloodHound CE or BloodHound Enterprise and runs the prebuilt query "Shortest Paths to Domain Admins from Owned Principals" or the Cypher query MATCH p=shortestPath((u:User {owned:true})-[*1..]->(g:Group {name:"DOMAIN ADMINS@DOMAIN"})) RETURN p. 4. BloodHound returns one or more paths, each made of edges such as MemberOf, AdminTo, HasSession, ForceChangePassword, AddMember, GenericAll, GenericWrite, WriteDacl, WriteOwner, AllExtendedRights, GPLink, AddSelf, AllowedToDelegate, AllowedToAct, DCSync, SyncLAPSPassword, ReadLAPSPassword, ReadGMSAPassword, CanRDP, ExecuteDCOM, SQLAdmin, HasSIDHistory. 5. Attacker walks the path one edge at a time using the appropriate tradecraft for each edge: Rubeus or impacket for delegation edges, PowerView Set-DomainObject for ACL edges, Mimikatz or Rubeus for session theft, certipy for ADCS edges, gMSADumper for ReadGMSAPassword, secretsdump for DCSync. 6. Path terminates with the attacker holding credentials for an account in Domain Admins or with the ability to coerce a DC to authenticate, at which point the domain is fully compromised.
Cómo lo evalúa Guerrilla
Guerrilla emits findings from the ADACL-001 through ADACL-015 checks into an in-memory adjacency list keyed on SID. Nodes are SIDs (resolved to sAMAccountName for display); edges carry a type (MemberOf, Owns, WriteDacl, WriteOwner, GenericAll, GenericWrite, ForceChangePassword, AddMember, AddSelf, AllExtendedRights, AllowedToDelegate, AllowedToAct, GetChanges, GetChangesAll, GPLink, CanRDP, HasSession, AdminTo, ReadLAPSPassword, ReadGMSAPassword, Enroll, AutoEnroll) and a confidence flag (explicit vs inherited, direct vs transitive group). Tier zero target sets are computed by reading the membership of the default protected groups (RID 512, 519, 518, 520, 548, 551, 550, 549) and the contents of the Domain Controllers OU plus any object with adminCount=1. The shortest-path search uses BFS from each non-tier-zero source set. For each path found, Guerrilla emits the full edge list, the hop count, and the principal at the start of the path. The data model is intentionally compatible with the BloodHound JSON schema (v6) so customers can re-ingest into BloodHound CE for visualization. Guerrilla does not collect sessions by default; session edges are included only if the customer enables the InvokeSessionEnumeration switch.
Valor recomendado
Ninguna vía de ataque viable desde usuarios sin privilegios hacia activos de Tier Zero; todas las vías identificadas remediadas o documentadas como riesgo aceptado
Remediación
Realice el análisis de vías de ataque con herramientas como BloodHound. Céntrese en las vías más cortas desde Domain Users o Authenticated Users hacia Domain Admins, Enterprise Admins y los controladores de dominio. Interrumpa las cadenas de ataque identificadas eliminando el eslabón más débil de cada vía. Priorice las vías que puedan explotarse sin herramientas especiales ni acceso elevado.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, RA-5, CA-8
- ANSSI
- vuln_attack_paths
- MITRE ATT&CK
- T1222.001, T1069.002, T1098