ADDOM-015: SMB Signing Requirements
- Plataforma
- Active Directory
- Categoría
- AD Domain & Forest Configuration
- Severidad
- Critical
- Pilar de Zero Trust
- Governance (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla reads four registry values per domain controller. On the server side: HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\RequireSecuritySignature (DWORD, must be 1) and HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\EnableSecuritySignature (DWORD, must be 1). On the client side: HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature (DWORD, must be 1) and HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature (DWORD, must be 1). These four keys correspond to the Group Policy settings "Microsoft network server: Digitally sign communications (always)", "Microsoft network server: Digitally sign communications (if client agrees)", "Microsoft network client: Digitally sign communications (always)", and "Microsoft network client: Digitally sign communications (if server agrees)". The check also queries the resultant SMB configuration via Get-SmbServerConfiguration and Get-SmbClientConfiguration over WinRM (RequireSecuritySignature and EnableSecuritySignature properties) to detect cases where the registry has been tampered with but the live SMB service has been reconfigured by a script. A finding is raised when RequireSecuritySignature is not 1 on either the server or client component of any inspected host. DCs running Windows Server 2025 or with the SMB over QUIC stack enabled are additionally checked for the RequireEncryption property since signing is implicit when encryption is enforced.
Por qué importa
NTLM relay against SMB is one of the most reliable paths from an initial network foothold to domain compromise and has been weaponized continuously since 2001. The attack does not require any credential theft, no Kerberoasting, no AS-REP roasting, and no exploitation of a CVE: it abuses the protocol's default willingness to negotiate sessions without integrity protection. When signing is not required on the receiving server, a relayed authentication produces a fully usable SMB session in the victim's context. If the victim is a domain controller computer account (coerced through PetitPotam, PrinterBug, ShadowCoerce, or DFSCoerce), the relayed session against another DC yields SYSTEM on that DC. If the victim is a high-privileged user (helpdesk, backup operator, server admin), the relayed session yields code execution on any server where that user has local admin. Once SMB signing is required on every server, the relayed authentication is rejected because the attacker cannot produce a valid signature without the victim's session key. CISA, NSA, and Microsoft have all repeatedly issued guidance to require SMB signing on every Windows host, and Microsoft made SMB signing required by default for SMB client and server on Windows 11 24H2 and Windows Server 2025. Earlier OS versions (Server 2022, 2019, 2016) still require explicit configuration via Group Policy.
Ruta de ataque
Step 1: Network position. The attacker gains any foothold on the same broadcast domain as the target (a phished workstation, a kiosk, a VOIP phone, a rogue Pi on the wired LAN, or a compromised VPN client). No domain credentials are required. Step 2: Poisoning. The attacker runs Responder (or Inveigh, mitm6, or krbrelayx) and listens for LLMNR, NBT-NS, mDNS, or WPAD broadcast queries. On dual-stack networks the attacker runs mitm6 to advertise themselves as the IPv6 DNS server via SLAAC, which silently captures DNS queries from every Windows host on the segment. Step 3: Coercion or opportunistic capture. Opportunistic: the attacker waits for a user or service to mistype a hostname or perform a stale SMB lookup, at which point Responder answers the name and the victim authenticates. Coerced: the attacker calls MS-EFSRPC EfsRpcOpenFileRaw (PetitPotam, CVE-2021-36942), MS-RPRN RpcRemoteFindFirstPrinterChangeNotification (PrinterBug), MS-FSRVP IsPathSupported (ShadowCoerce), or MS-DFSNM NetrDfsAddStdRoot (DFSCoerce) against a target DC. The DC computer account immediately authenticates to the attacker's controlled UNC path. Step 4: Relay. Instead of cracking the captured NTLM handshake offline, the attacker runs impacket-ntlmrelayx -t smb://DC02 -smb2support and forwards the handshake to a second domain controller or any server where the victim has local admin. If signing is required on the target server, the relayed session is rejected at protocol negotiation. If signing is not required, the session is accepted in the victim's security context. Step 5: Action on objective. The attacker now has SMB session as the victim against the target server. Common follow-ons: ntlmrelayx -socks to spawn an interactive impacket-smbexec session, --add-computer to create a new computer account for RBCD abuse, --escalate-user to grant DCSync rights on the domain root, or relay to LDAP/LDAPS on a DC to set msDS-AllowedToActOnBehalfOfOtherIdentity for a resource-based constrained delegation takeover. When the victim is a DC computer account and the relay target is another DC, the result is SYSTEM on that DC and immediate DCSync capability for the entire domain.
Cómo lo evalúa Guerrilla
The check enumerates every domain controller from the (objectCategory=computer)(primaryGroupID=516) query and from RootDSE dnsHostName values. For each DC it opens a remote registry connection (or invokes Get-SmbServerConfiguration and Get-SmbClientConfiguration over WinRM as a fallback) and reads RequireSecuritySignature and EnableSecuritySignature on both LanmanServer and LanmanWorkstation under HKLM\SYSTEM\CurrentControlSet\Services. The cmdlet also pulls the resultant Group Policy via gpresult /scope:computer to identify which GPO sets the value, so the operator can fix the policy rather than the registry. For member servers (when invoked with the -IncludeMemberServers switch) the same four registry values are read at scale via PowerShell remoting. A host fails when RequireSecuritySignature on the server or client component is anything other than 1. The check additionally captures the SMB dialects offered by the host (Get-SmbServerConfiguration EnableSMB1Protocol, EnableSMB2Protocol) so that hosts still offering SMB1 (which has no signing support against modern relays) are surfaced as compounding findings against ADDOM-016 and ADNET checks.
Valor recomendado
SMB signing required on all domain controllers and member servers
Remediación
Configure via Group Policy: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > 'Microsoft network server: Digitally sign communications (always)' = Enabled. Apply to Domain Controllers OU and all server OUs
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-8, SC-8(1)
- CIS Benchmark
- 2.3.8.1, 2.3.8.2
- ANSSI
- R26
- NSA / ASD
- SMB-1
- CIS AD Benchmark
- 2.2.1
- MITRE ATT&CK
- T1557, T1021.002