ADDOM-011: Site Link Configuration
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- Low
- Pilar de Zero Trust
- Governance (peso 0)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla binds to the Configuration naming context (CN=Sites,CN=Configuration,DC=<forest-root>) and enumerates two objects under CN=Inter-Site Transports: the IP transport container (CN=IP) and the SMTP transport container (CN=SMTP) where present. For every (objectClass=siteLink) under CN=IP the check reads cn, siteList (DN list of CN=<site>,CN=Sites,CN=Configuration), cost (integer, default 100), replInterval (integer minutes, default 180), schedule (octet string, 168-byte bitmap, byte per hour per day, default null meaning 24x7), and options (bitmask, bit 0 = USE_NOTIFY for change notification, bit 1 = TWOWAY_SYNC, bit 2 = DISABLE_COMPRESSION). It also reads CN=NTDS Site Settings under each site for the per-site bridgehead policy and reads the SiteLinkBridge objects (CN=Inter-Site Transports,CN=IP) along with the options bit on the IP transport itself (bit 0x2 controls whether site link bridging is enabled forest-wide, default on). The check fails on the following conditions: replInterval greater than 60 on any link spanning sites that host DCs with privileged accounts, schedule that blocks replication for any contiguous block longer than 2 hours, two or more site links with identical cost across topologically distinct WAN paths (the KCC cannot disambiguate), USE_NOTIFY not set on intra-MPLS or LAN-class links where it is safe to enable, or DISABLE_COMPRESSION set on links above 64 kbps where compression should remain on. The output records the site link DN, all three numeric values, the decoded options bitmask, and the schedule decoded into the longest blackout window.
Por qué importa
Site link timing is a security control because Active Directory uses inter-site replication to propagate the very changes that contain or recover from compromise. A password reset performed during incident response on the forest root DC propagates to the bridgehead in the affected site only on the next replication interval. If that interval is the default 180 minutes and the schedule further restricts replication to overnight hours, a compromised account can continue to authenticate against a DC in a remote site for up to a full day after the reset. The same applies to account disable, kerberos password rollovers for the krbtgt account (where lag widens the window during which old TGTs minted by an attacker remain valid for inter-site service ticket requests), group membership changes that remove a user from a Tier 0 group, GPO version increments that deploy a new restricted groups policy, and SID history modifications used to retire migrated trusts. Outside the incident-response case, long replication intervals also slow down the propagation of authoritative time, of new computer accounts in tiering OUs, and of changes to authentication policy silo assignments. The blast radius is the set of remote sites whose DCs lag the change, and the window is the replication interval plus any scheduled blackout. Misconfigured cost values create a second-order problem: when the KCC cannot pick a single shortest path between two sites (because two links have equal cost), the resulting topology can favor a longer WAN hop, which compounds the propagation delay. Site links are also write-protected only by the Enterprise Admins ACL on the Configuration NC, so an attacker who has reached Enterprise Admin (the typical end state of a forest compromise) can modify replInterval or schedule to slow defender response, a tactic documented in inter-site topology tampering scenarios that map to T1484.002.
Ruta de ataque
Step 1: reconnaissance. The Configuration naming context is readable by any authenticated user. The attacker enumerates site links with a single LDAP query: Get-ADObject -SearchBase "CN=IP,CN=Inter-Site Transports,CN=Sites,$((Get-ADRootDSE).configurationNamingContext)" -Filter "objectClass -eq 'siteLink'" -Properties cost, replInterval, schedule, siteList, options. The same output is produced by repadmin /showrepl /csv and by BloodHound when collecting the Sites edge set. Long intervals and schedule gaps are visible in the result and tell the attacker which remote sites lag the forest root. Step 2: foothold selection. The attacker prefers to operate against a DC in a high-lag remote site. Kerberoasting a service account using a service ticket obtained from that DC, then cracking the hash, gives the attacker a credential that the rest of the forest may not learn is compromised for the duration of the replication interval. The same logic applies to AS-REP roasting and to silver ticket creation against services whose machine account hash was harvested from the remote DC. Step 3: action on objectives during the lag window. If the defender resets the kerberoasted account password on the PDC emulator, the new password reaches the remote DC only at the next replication slot. Until then, the attacker continues to request service tickets against the remote DC using the old password. The same primitive lets an attacker use an account that has been formally disabled or removed from a privileged group at the forest root for as long as the lag persists. Step 4: optional tampering. An attacker who already holds Enterprise Admin can extend the lag by editing replInterval (the maximum supported value is 10080 minutes, one week) or by overwriting the schedule attribute with a bitmap that blocks replication for most of the day. This raises the cost of incident response by widening the window during which any defensive change is invisible to the affected site. The change is itself a single LDAP write and is logged only if directory service auditing is enabled (event 5136 against the Configuration NC), which is frequently not the case in the default audit policy. The attacker tooling is the standard kit: ldapsearch, PowerView, BloodHound for discovery; Rubeus and Impacket for ticket abuse; built-in LDAP writes or Set-ADReplicationSiteLink for tampering.
Cómo lo evalúa Guerrilla
The check is a pure LDAP read against the Configuration naming context. Guerrilla retrieves configurationNamingContext from rootDSE, then enumerates CN=IP,CN=Inter-Site Transports,CN=Sites under that NC and pulls every child (objectClass=siteLink). For each link it reads cn, distinguishedName, cost, replInterval, schedule, siteList, options, and whenChanged. The schedule attribute is decoded from its 168-byte octet form into a 7x24 boolean matrix; the longest contiguous run of disallowed hours becomes the blackout window. The check then applies four rules: (a) flag replInterval greater than 60 minutes, (b) flag any blackout window longer than 120 minutes, (c) flag links whose cost is the unmanaged default 100 when more than one link exists (suggests no topology design), (d) flag the DEFAULTIPSITELINK if it still binds every site (suggests the forest has not been split into named site links per WAN region). The same query path retrieves the IP transport options attribute (CN=IP itself) to confirm whether site link bridging is enabled. Because every read is against the Configuration NC, the check requires no DC remoting, no event log access, and no elevated rights beyond authenticated user.
Valor recomendado
Site links configured with appropriate costs and replication intervals of 15-60 minutes depending on link capacity
Remediación
Review AD Sites and Services > Inter-Site Transports > IP. Verify each site link has appropriate cost values, replication interval (default 180 minutes is often too long), and schedule. Adjust based on network topology
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-36, CM-6
- CIS AD Benchmark
- 1.5.2
- MITRE ATT&CK
- T1557