ADDOM-009: AD Recycle Bin Status
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla queries the Recycle Bin Feature object in the forest configuration partition at CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=<forest>. The check reads the msDS-EnabledFeature attribute on the CN=Partitions,CN=Configuration,DC=<forest> container and verifies that the Recycle Bin Feature GUID is present as a linked value. The cmdlet also calls Get-ADOptionalFeature with the filter Name -eq "Recycle Bin Feature" and inspects EnabledScopes. A non-empty EnabledScopes collection that includes the forest NC head means the feature is enabled, an empty collection means it is not. The check fails when EnabledScopes is empty or msDS-EnabledFeature does not reference the Recycle Bin Feature GUID.
Por qué importa
Without the Recycle Bin, the default tombstone behavior strips most attributes from a deleted object at the moment of deletion. Group memberships, SID history, manager, member, memberOf, userAccountControl flags, and most extension attributes are gone. The object stays in the Deleted Objects container as a tombstone for the tombstone lifetime (180 days by default on modern forests), but tombstone reanimation only restores the object skeleton, not its attributes. The defender is then forced to perform an authoritative restore from a System State backup of a writable DC, mark the relevant objects as authoritative with ntdsutil, and replicate the restored data forest-wide. That path is slow, requires recent backups, and produces measurable downtime for any group, OU, or GPO that was deleted. From a ransomware and destructive-attack perspective this is the difference between a minutes-long recovery (reanimate from the Recycle Bin) and an hours- or days-long forest recovery (authoritative restore). The blast radius is the entire forest because the feature is enabled at the forest scope and applies to every domain in the forest.
Ruta de ataque
A destructive attacker who has obtained Domain Admin or equivalent rights frequently includes mass directory object deletion in the kill chain because it inhibits incident response and amplifies the operational impact of the attack. Public incident reporting from Mandiant and Microsoft Incident Response shows ransomware operators (Conti, LockBit affiliates, and Black Basta) executing Remove-ADObject, Remove-ADUser, or low-level LDAP delete operations against entire OUs containing service accounts, privileged users, or backup operator accounts as part of the wipe phase. Without the Recycle Bin, every deleted object must be reconstructed from backup. The attacker does not need any new technique to abuse this gap, the absence of the feature simply turns ordinary deletion into a recovery problem. MITRE ATT&CK frames this as T1485 (Data Destruction), T1531 (Account Access Removal), and T1490 (Inhibit System Recovery) when the deletion is intended to prevent rollback. Bulk deletion via ADSI or LDAP can be performed with a one-line PowerShell, with ldp.exe, or with custom scripts, and is also a known insider-threat pattern.
Cómo lo evalúa Guerrilla
The check binds to LDAP, reads the msDS-EnabledFeature link-valued attribute on CN=Partitions,CN=Configuration,DC=<forest>, and resolves each GUID against the CN=Optional Features container to confirm whether the Recycle Bin Feature GUID (well-known DN: CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=<forest>) is enabled at the forest scope. The cmdlet also runs Get-ADOptionalFeature -Filter "Name -eq 'Recycle Bin Feature'" and parses EnabledScopes. Guerrilla emits the raw EnabledScopes value, the forest functional level (the feature requires Windows Server 2008 R2 FFL or higher), and the deleted object lifetime in days so that the operator has the full recovery posture in a single observation.
Valor recomendado
Enabled
Remediación
Enable AD Recycle Bin via Active Directory Administrative Center > right-click domain > Enable Recycle Bin, or run Enable-ADOptionalFeature 'Recycle Bin Feature' in PowerShell. Note: this action is irreversible
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CP-9, CP-10
- CIS Benchmark
- 18.3.1
- CIS AD Benchmark
- 1.4.2
- MITRE ATT&CK
- T1485