ADGPO-014: MSI Packages in GPOs
- Plataforma
- Active Directory
- Categoría
- AD Group Policy
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
For each GPO returned by Get-GPO -All, the check parses the XML report for Software Installation extensions in both Computer Configuration (Software Settings\Software installation) and User Configuration. The relevant XML nodes live under GPO/Computer/ExtensionData/Extension where the namespace is the Software Installation CSE GUID {c6dc5466-785a-11d2-84d0-00c04fb169f7}. For every package the check captures: ProductCode (GUID), PackageName, PackagePath (UNC), DeploymentType (Assigned, Published), DeploymentInstallationContext (Machine, User), UpgradeOf references, LanguageId, and the categories. It then resolves the PackagePath: it verifies the share exists, reads the share-level permissions via Get-SmbShare and Get-SmbShareAccess, reads the NTFS ACL on the MSI file and on the containing folder via Get-Acl, computes the SHA256 of the MSI, reads the Authenticode signature with Get-AuthenticodeSignature, and extracts the embedded MSI metadata (Subject, Manufacturer, ProductVersion, ProductName) from the _SummaryInformation stream. A package is flagged when any of the following is true: the share or NTFS ACL grants modify or write rights to Authenticated Users, Domain Users, Domain Computers, Everyone, or any non-Tier-0 principal; the source path points outside SYSVOL or a known administrative share; the Authenticode signature is missing, invalid, or chains to an untrusted root; the MSI publisher does not match an approved vendor list; or the package file is not readable from the audit host.
Por qué importa
Software Installation policies execute as NT AUTHORITY\SYSTEM on every targeted machine at the next startup (for Assigned to Computer) or at logon (for Assigned to User with elevated install). The Windows Installer service does not prompt, does not check Mark-of-the-Web, and by default does not enforce Authenticode signature validation on the MSI. Whoever can write to the MSI source path can replace the package with a malicious one and obtain SYSTEM execution on every machine the GPO targets at the next refresh. This is a classic supply-chain primitive inside the domain. Three failure modes recur in real environments: (1) the MSI lives on a general-purpose file share where Domain Users have Modify, often because the share was created for the helpdesk and never re-ACLed; (2) the MSI lives on a workstation or a decommissioned server whose hostname still resolves but whose share permissions are unknown; (3) the MSI is a third-party installer copied from a vendor portal without signature verification, so the original is already untrusted. The blast radius scales with the GPO link scope: a Software Installation GPO linked at the domain root or the Domain Controllers OU yields code execution on every DC. The same primitive also enables persistence: an attacker who has GPO edit rights can add a new Software Installation entry pointing at a malicious MSI on a share they control, and the package will re-install on every targeted machine even after endpoint cleanup, because the Group Policy engine treats the assignment as authoritative.
Ruta de ataque
1. Discovery: with any domain-authenticated context, the attacker enumerates GPOs and their Software Installation entries. Get-GPO -All piped to Get-GPOReport -ReportType Xml, or PowerView Get-DomainGPO, exposes every package path. BloodHound surfaces GPOs linked to high-value OUs. 2. Source-path triage: for each MSI UNC, the attacker tests write access. net use \\fileserver\software, then dir and a write probe, or Find-InterestingDomainShareFile from PowerView, identifies shares where the current user has Modify on the MSI or on the parent folder. Shares hosted on workstations or decommissioned servers are common wins. 3. Payload preparation: the attacker builds a trojanized MSI. msfvenom -f msi, WiX with a custom action calling powershell.exe, or a wrapper that runs the original installer plus a payload. The malicious MSI keeps the same ProductCode so Windows Installer treats it as the same product and does not roll back targeted machines. 4. Replacement: the attacker overwrites the MSI on the share. No GPO change is needed, no SYSVOL replication is involved, no Event ID 5136 fires on the GPO object. 5. Execution: at the next gpupdate or reboot, the Group Policy Software Installation CSE detects that the assigned package needs to be installed (or re-installed if the version changed) and Windows Installer runs the MSI as SYSTEM on every targeted machine. For computer-assigned packages, this happens at boot before user logon, which defeats most user-mode EDR hooks. 6. Alternative path: if the attacker has GPO edit rights instead of share write rights, they create a new Software Installation entry in an existing GPO, pointing at an MSI on a share they control. SharpGPOAbuse and PowerView Set-DomainObject support this path. Linking to the Domain Controllers OU yields domain-wide SYSTEM. 7. Persistence: because the package is Assigned, the Group Policy engine reinstalls it if it is removed, until the GPO entry itself is deleted.
Cómo lo evalúa Guerrilla
Guerrilla loads the GroupPolicy and SmbShare modules, calls Get-GPO -All -Domain $env:USERDNSDOMAIN, then for each GPO calls Get-GPOReport -Guid $gpo.Id -ReportType Xml. The XML is parsed with [xml] cast and the check walks GPO.Computer.ExtensionData.Extension and GPO.User.ExtensionData.Extension looking for the Software Installation CSE GUID {c6dc5466-785a-11d2-84d0-00c04fb169f7}. For each MsiApplication node it extracts Name, Path, ProductCode, DeploymentType, and InstallationUiLevel. The UNC Path is split into server and share. The check resolves the server via Resolve-DnsName, opens the share via Get-SmbShareAccess (when run from a host with rights), reads the NTFS ACL via Get-Acl on \\server\share\path, and computes Get-FileHash -Algorithm SHA256 on the MSI. Get-AuthenticodeSignature returns SignerCertificate, Status, and StatusMessage. The MSI _SummaryInformation stream is read via the WindowsInstaller.Installer COM object (OpenDatabase, OpenView on _SummaryInformation, GetSummaryInformation) to extract Subject, Author, Title, and Template. Output rows include GpoName, GpoId, PackageName, PackagePath, ProductCode, DeploymentType, ShareAcl, NtfsAcl, Sha256, SignatureStatus, SignerSubject, Publisher, IsHighRisk (bool), and a Notes field that enumerates the specific failure reasons.
Valor recomendado
All GPO-deployed MSI packages sourced from secure, access-controlled locations with verified integrity
Remediación
Identify all software installation settings in GPOs. Verify that MSI source paths point to secured shares with appropriate NTFS and share permissions. Confirm that MSI packages are from trusted vendors and have not been tampered with. Consider using WDAC or AppLocker to restrict MSI installation to approved packages.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-5, CM-7(5), SI-7
- MITRE ATT&CK
- T1484.001, T1072