ADDOM-011: Configuración de vínculos de sitio
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- Low
- Pilar de Zero Trust
- Governance (peso 0)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Los vínculos de sitio de AD deben configurarse con un costo, un intervalo de replicación y una programación apropiados para garantizar una replicación oportuna respetando a la vez las restricciones de red. Los vínculos de sitio mal configurados pueden retrasar la propagación de las políticas de seguridad
Por qué importa
Site link timing is a security control because Active Directory uses inter-site replication to propagate the very changes that contain or recover from compromise. A password reset performed during incident response on the forest root DC propagates to the bridgehead in the affected site only on the next replication interval. If that interval is the default 180 minutes and the schedule further restricts replication to overnight hours, a compromised account can continue to authenticate against a DC in a remote site for up to a full day after the reset. The same applies to account disable, kerberos password rollovers for the krbtgt account (where lag widens the window during which old TGTs minted by an attacker remain valid for inter-site service ticket requests), group membership changes that remove a user from a Tier 0 group, GPO version increments that deploy a new restricted groups policy, and SID history modifications used to retire migrated trusts. Outside the incident-response case, long replication intervals also slow down the propagation of authoritative time, of new computer accounts in tiering OUs, and of changes to authentication policy silo assignments. The blast radius is the set of remote sites whose DCs lag the change, and the window is the replication interval plus any scheduled blackout. Misconfigured cost values create a second-order problem: when the KCC cannot pick a single shortest path between two sites (because two links have equal cost), the resulting topology can favor a longer WAN hop, which compounds the propagation delay. Site links are also write-protected only by the Enterprise Admins ACL on the Configuration NC, so an attacker who has reached Enterprise Admin (the typical end state of a forest compromise) can modify replInterval or schedule to slow defender response, a tactic documented in inter-site topology tampering scenarios that map to T1484.002.
Ruta de ataque
Step 1: reconnaissance. The Configuration naming context is readable by any authenticated user. The attacker enumerates site links with a single LDAP query: Get-ADObject -SearchBase "CN=IP,CN=Inter-Site Transports,CN=Sites,$((Get-ADRootDSE).configurationNamingContext)" -Filter "objectClass -eq 'siteLink'" -Properties cost, replInterval, schedule, siteList, options. The same output is produced by repadmin /showrepl /csv and by BloodHound when collecting the Sites edge set. Long intervals and schedule gaps are visible in the result and tell the attacker which remote sites lag the forest root. Step 2: foothold selection. The attacker prefers to operate against a DC in a high-lag remote site. Kerberoasting a service account using a service ticket obtained from that DC, then cracking the hash, gives the attacker a credential that the rest of the forest may not learn is compromised for the duration of the replication interval. The same logic applies to AS-REP roasting and to silver ticket creation against services whose machine account hash was harvested from the remote DC. Step 3: action on objectives during the lag window. If the defender resets the kerberoasted account password on the PDC emulator, the new password reaches the remote DC only at the next replication slot. Until then, the attacker continues to request service tickets against the remote DC using the old password. The same primitive lets an attacker use an account that has been formally disabled or removed from a privileged group at the forest root for as long as the lag persists. Step 4: optional tampering. An attacker who already holds Enterprise Admin can extend the lag by editing replInterval (the maximum supported value is 10080 minutes, one week) or by overwriting the schedule attribute with a bitmap that blocks replication for most of the day. This raises the cost of incident response by widening the window during which any defensive change is invisible to the affected site. The change is itself a single LDAP write and is logged only if directory service auditing is enabled (event 5136 against the Configuration NC), which is frequently not the case in the default audit policy. The attacker tooling is the standard kit: ldapsearch, PowerView, BloodHound for discovery; Rubeus and Impacket for ticket abuse; built-in LDAP writes or Set-ADReplicationSiteLink for tampering.
Cómo lo evalúa Guerrilla
The check is a pure LDAP read against the Configuration naming context. Guerrilla retrieves configurationNamingContext from rootDSE, then enumerates CN=IP,CN=Inter-Site Transports,CN=Sites under that NC and pulls every child (objectClass=siteLink). For each link it reads cn, distinguishedName, cost, replInterval, schedule, siteList, options, and whenChanged. The schedule attribute is decoded from its 168-byte octet form into a 7x24 boolean matrix; the longest contiguous run of disallowed hours becomes the blackout window. The check then applies four rules: (a) flag replInterval greater than 60 minutes, (b) flag any blackout window longer than 120 minutes, (c) flag links whose cost is the unmanaged default 100 when more than one link exists (suggests no topology design), (d) flag the DEFAULTIPSITELINK if it still binds every site (suggests the forest has not been split into named site links per WAN region). The same query path retrieves the IP transport options attribute (CN=IP itself) to confirm whether site link bridging is enabled. Because every read is against the Configuration NC, the check requires no DC remoting, no event log access, and no elevated rights beyond authenticated user.
Valor recomendado
Vínculos de sitio configurados con costos apropiados e intervalos de replicación de 15 a 60 minutos según la capacidad del enlace
Remediación
Revise Sitios y servicios de Active Directory > Transportes entre sitios > IP. Verifique que cada vínculo de sitio tenga valores de costo apropiados, un intervalo de replicación (el valor predeterminado de 180 minutos suele ser demasiado largo) y una programación adecuados. Ajuste según la topología de red
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-36, CM-6
- CIS AD Benchmark
- 1.5.2
- MITRE ATT&CK
- T1557