ADDOM-002: Nivel funcional del dominio
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El nivel funcional del dominio de Active Directory debe estar en Windows Server 2016 o superior. Los niveles funcionales inferiores impiden el uso de funciones de seguridad críticas, incluidas la funcionalidad del grupo Protected Users, las políticas de autenticación y el Kerberos armoring moderno
Por qué importa
The DFL is the gate Microsoft uses to introduce new directory-side security primitives without breaking older domain controllers. The features that ship behind DFL 7 (Windows Server 2016) are the ones most relevant to credential theft defense: - Protected Users group: KDC-side enforcement that members cannot use NTLM, cannot use DES or RC4 Kerberos cipher suites, cannot use unconstrained delegation, cannot be delegated via constrained delegation, and that TGT lifetime is capped at four hours. Without DFL 7, the group exists but the KDC enforcement is partial; lower DFLs leak the most important controls. - Authentication policies and authentication policy silos: directory-stored policy objects that bind a user, computer, or service account to a set of allowed sign-in workstations, lifetime, and required claim types. Silos are the supported mechanism for Tier 0 isolation and are unavailable below DFL 7. - Kerberos armoring (FAST) compound identity: enforced FAST on KDC requests requires DFL 7 to advertise the capability across the domain. - Privileged Access Management feature set, including shadow security principals from a bastion forest. A domain stuck at Windows Server 2008 R2 or 2012 R2 leaves an environment unable to deploy any of the above. Operationally that means there is no enforceable way to prevent a Domain Admin account from being used over NTLM, no way to bind krbtgt and tier-0 service accounts to specific privileged access workstations, and no way to enforce armored AS-REQ. The blast radius is the entire domain: every credential theft mitigation Microsoft has shipped in the last decade is silently disabled.
Ruta de ataque
A low DFL is not itself an exploit. It is a precondition that unlocks attacks elsewhere in the kill chain. Typical sequence: Step 1: Initial access. The attacker establishes a foothold on any domain-joined workstation via phishing, exposed RDP, or a vulnerable internet-facing service. Step 2: Credential harvesting. The attacker runs Rubeus or Mimikatz against LSASS and harvests TGTs and NTLM hashes for any account that has logged on. Because Protected Users enforcement is not gated by DFL 7, accounts the organization believes are protected (added to the Protected Users group) still cache RC4 long-term keys and NTLM hashes on workstations. Step 3: Lateral movement via overpass-the-hash. The attacker uses Rubeus asktgt /user:admin /rc4:<hash> to mint a TGT from a stolen RC4 hash. With DFL 7 and Protected Users enforcement the KDC would refuse to issue a TGT that uses RC4 for a member of Protected Users; with DFL below 7 the KDC happily issues the ticket. Step 4: Tier-0 pivot. The attacker identifies a domain admin account and looks for authentication policy silo membership. Because the DFL is too low to support silos, no silo exists, so there is no directory-side restriction on which workstation the admin can be used from. The attacker uses the stolen credential against any DC. Step 5: Persistence. The attacker performs DCSync, extracts the krbtgt hash, and forges Golden Tickets. With DFL 7 and authentication policies, an organization could at least bind krbtgt-derived authentications to known endpoints; below DFL 7 that control is unavailable. The attack uses no zero-day. The DFL is the missing control that makes commodity tools (Rubeus, Mimikatz, Impacket secretsdump, Impacket getTGT) effective end to end.
Cómo lo evalúa Guerrilla
Guerrilla performs a single LDAP read on the domain naming context root: Get-ADObject -Identity (Get-ADDomain).DistinguishedName -Properties msDS-Behavior-Version. The returned integer is compared against the constant 7 (DOMAIN_BEHAVIOR_WIN2016). Any value less than 7 produces a fail. The check also surfaces the human-readable name via the .NET enumeration System.DirectoryServices.ActiveDirectory.DomainMode for operator output. As a secondary signal, Guerrilla queries (&(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192)) to list every domain controller, reads operatingSystemVersion, and reports the minimum DC OS build. If any DC reports an OS older than Windows Server 2016 (build 10.0.14393), the remediation is blocked until that DC is decommissioned or upgraded, and Guerrilla calls that out explicitly so the operator does not attempt a raise that will fail. The check is read-only and runs entirely over LDAP and Active Directory Web Services on TCP 9389.
Valor recomendado
Windows Server 2016 o superior
Remediación
Eleve el nivel funcional del dominio a través de Dominios y confianzas de Active Directory > clic derecho en el dominio > Elevar el nivel funcional del dominio. Verifique primero que todos los DC del dominio ejecuten una versión de SO compatible
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-6, SI-2
- CIS Benchmark
- 18.3.1
- ANSSI
- R1
- CIS AD Benchmark
- 1.1.2
- MITRE ATT&CK
- T1078.002