ADDOM-007: Estado de la replicación de AD
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 0)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Los errores de replicación de Active Directory pueden provocar una aplicación inconsistente de las políticas de seguridad, que credenciales obsoletas sigan siendo válidas y escenarios de split-brain. Los errores de replicación persistentes también pueden indicar un DC comprometido o no autorizado
Por qué importa
Replication is the foundation of every security control that AD enforces. If replication is broken, security operations silently lose ground in three ways. First, account state is no longer authoritative: a disabled account, reset password, or revoked Domain Admin membership only protects the resources that authenticate through a DC that has received the change. Second, Group Policy delivery becomes inconsistent: a hardening GPO (LAPS, NTLM restrictions, AppLocker, RDP NLA) may apply to half the fleet while the other half stays exposed. Third, replication failure is the loudest indicator of rogue DC activity. DCShadow (T1207) and DCSync (T1003.006) both abuse the Directory Replication Service Remote Protocol (DRSR / DRSUAPI), and a DC that fails to replicate outbound while injecting changes inbound is one of the cleanest detection signals defenders have. A 14-day tombstone-lifetime gap also creates lingering objects, which can later be replicated back into the directory and resurrect deleted accounts, including disabled service accounts and removed group memberships.
Ruta de ataque
An attacker exploits poor replication health in two distinct ways. The first is opportunistic: when a tenant operator resets a compromised account password on DC-A but the change never replicates to DC-B in a remote site, the attacker continues to authenticate against DC-B with the old password for as long as the failure persists. The same is true for disabled accounts, revoked group memberships, and updated GPO links. Mandiant has documented this pattern in nation-state intrusions where the actor specifically targeted poorly connected branch-site DCs as long-lived authentication endpoints. The second path is active replication abuse. With Domain Admin or equivalent rights, an attacker registers a rogue DC using Mimikatz lsadump::dcshadow (Vincent Le Toux and Benjamin Delpy, BlackHat 2018), pushes attribute changes (such as adding a SID to sIDHistory, modifying primaryGroupID, or planting a backdoor on an OU ACL), and then unregisters. The push is performed via legitimate DRSUAPI replication, so a SIEM tuned to object modification on a known DC sees nothing. Persistent legitimate replication failures hide rogue-DC failures inside the noise, and a defender who has trained the operations team to ignore replication errors loses the single best detection vector. T1003.006 DCSync follows the same protocol path to extract the krbtgt hash and every account hash in the domain.
Cómo lo evalúa Guerrilla
Guerrilla queries the rootDSE of each DC to enumerate naming contexts, then reads repsFrom and repsTo on each NC head using LDAP control LDAP_SERVER_DIRSYNC_OID or, where available, the DsReplicaGetInfo (DS_REPL_INFO_NEIGHBORS) RPC equivalent surfaced through Get-ADReplicationPartnerMetadata. For each partner-NC tuple the check captures lastReplicationSuccess, lastReplicationResult, consecutiveReplicationFailures, and the highest USN seen. The cmdlet cross-references the highest USN per DC against the previous run stored in the Guerrilla state file to detect USN rollback (current USN lower than the stored value, which indicates the DC was restored from a snapshot or image rather than recovered through supported AD restore). It also enumerates Directory Service event log entries 1311, 1388, 1925, 1988, 2042, 2087, 2088, and 5805 across each DC to surface KCC topology failures, lingering object events, and authentication failures on the replication channel.
Valor recomendado
Todos los controladores de dominio replicando correctamente sin errores en las últimas 24 horas
Remediación
Ejecute 'repadmin /replsummary' y 'repadmin /showrepl' para identificar los errores. Investigue y resuelva problemas de DNS, problemas de conectividad de red o condiciones de USN rollback. Supervise el estado de la replicación como parte de las operaciones rutinarias
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-36, CP-10
- CIS Benchmark
- 18.3.1
- CIS AD Benchmark
- 1.3.1
- MITRE ATT&CK
- T1207