ADDOM-007: AD Replication Health
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 0)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla enumerates every domain controller in every domain of the forest from the CN=Sites,CN=Configuration partition (NTDS Settings objects under each server) and then evaluates replication health for each one. For each source-destination pair the check reads the repsFrom and repsTo metadata on each naming context (Schema, Configuration, Domain, ForestDnsZones, DomainDnsZones), records the last successful replication time, the last failure time, the consecutive failure count, and the Win32 result code from the most recent attempt. The check fails when any DC reports a consecutive failure count greater than zero on any naming context within the last 24 hours, when any DC has not received an inbound change from a partner within its tombstone lifetime, or when USN values regress (the signature of USN rollback or a restored-from-image DC).
Por qué importa
Replication is the foundation of every security control that AD enforces. If replication is broken, security operations silently lose ground in three ways. First, account state is no longer authoritative: a disabled account, reset password, or revoked Domain Admin membership only protects the resources that authenticate through a DC that has received the change. Second, Group Policy delivery becomes inconsistent: a hardening GPO (LAPS, NTLM restrictions, AppLocker, RDP NLA) may apply to half the fleet while the other half stays exposed. Third, replication failure is the loudest indicator of rogue DC activity. DCShadow (T1207) and DCSync (T1003.006) both abuse the Directory Replication Service Remote Protocol (DRSR / DRSUAPI), and a DC that fails to replicate outbound while injecting changes inbound is one of the cleanest detection signals defenders have. A 14-day tombstone-lifetime gap also creates lingering objects, which can later be replicated back into the directory and resurrect deleted accounts, including disabled service accounts and removed group memberships.
Ruta de ataque
An attacker exploits poor replication health in two distinct ways. The first is opportunistic: when a tenant operator resets a compromised account password on DC-A but the change never replicates to DC-B in a remote site, the attacker continues to authenticate against DC-B with the old password for as long as the failure persists. The same is true for disabled accounts, revoked group memberships, and updated GPO links. Mandiant has documented this pattern in nation-state intrusions where the actor specifically targeted poorly connected branch-site DCs as long-lived authentication endpoints. The second path is active replication abuse. With Domain Admin or equivalent rights, an attacker registers a rogue DC using Mimikatz lsadump::dcshadow (Vincent Le Toux and Benjamin Delpy, BlackHat 2018), pushes attribute changes (such as adding a SID to sIDHistory, modifying primaryGroupID, or planting a backdoor on an OU ACL), and then unregisters. The push is performed via legitimate DRSUAPI replication, so a SIEM tuned to object modification on a known DC sees nothing. Persistent legitimate replication failures hide rogue-DC failures inside the noise, and a defender who has trained the operations team to ignore replication errors loses the single best detection vector. T1003.006 DCSync follows the same protocol path to extract the krbtgt hash and every account hash in the domain.
Cómo lo evalúa Guerrilla
Guerrilla queries the rootDSE of each DC to enumerate naming contexts, then reads repsFrom and repsTo on each NC head using LDAP control LDAP_SERVER_DIRSYNC_OID or, where available, the DsReplicaGetInfo (DS_REPL_INFO_NEIGHBORS) RPC equivalent surfaced through Get-ADReplicationPartnerMetadata. For each partner-NC tuple the check captures lastReplicationSuccess, lastReplicationResult, consecutiveReplicationFailures, and the highest USN seen. The cmdlet cross-references the highest USN per DC against the previous run stored in the Guerrilla state file to detect USN rollback (current USN lower than the stored value, which indicates the DC was restored from a snapshot or image rather than recovered through supported AD restore). It also enumerates Directory Service event log entries 1311, 1388, 1925, 1988, 2042, 2087, 2088, and 5805 across each DC to surface KCC topology failures, lingering object events, and authentication failures on the replication channel.
Valor recomendado
All domain controllers replicating successfully with no errors in the last 24 hours
Remediación
Run 'repadmin /replsummary' and 'repadmin /showrepl' to identify failures. Investigate and resolve DNS issues, network connectivity problems, or USN rollback conditions. Monitor replication status as part of routine operations
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-36, CP-10
- CIS Benchmark
- 18.3.1
- CIS AD Benchmark
- 1.3.1
- MITRE ATT&CK
- T1207