ADGPO-014: Paquetes MSI en GPO
- Plataforma
- Active Directory
- Categoría
- AD Group Policy
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las configuraciones de instalación de software de las GPO despliegan paquetes MSI en los equipos de destino. Los paquetes MSI comprometidos o no autorizados en las GPO pueden desplegar malware por todo el dominio. La ubicación de origen de los paquetes MSI y los controles de acceso sobre esas ubicaciones deben verificarse
Por qué importa
Software Installation policies execute as NT AUTHORITY\SYSTEM on every targeted machine at the next startup (for Assigned to Computer) or at logon (for Assigned to User with elevated install). The Windows Installer service does not prompt, does not check Mark-of-the-Web, and by default does not enforce Authenticode signature validation on the MSI. Whoever can write to the MSI source path can replace the package with a malicious one and obtain SYSTEM execution on every machine the GPO targets at the next refresh. This is a classic supply-chain primitive inside the domain. Three failure modes recur in real environments: (1) the MSI lives on a general-purpose file share where Domain Users have Modify, often because the share was created for the helpdesk and never re-ACLed; (2) the MSI lives on a workstation or a decommissioned server whose hostname still resolves but whose share permissions are unknown; (3) the MSI is a third-party installer copied from a vendor portal without signature verification, so the original is already untrusted. The blast radius scales with the GPO link scope: a Software Installation GPO linked at the domain root or the Domain Controllers OU yields code execution on every DC. The same primitive also enables persistence: an attacker who has GPO edit rights can add a new Software Installation entry pointing at a malicious MSI on a share they control, and the package will re-install on every targeted machine even after endpoint cleanup, because the Group Policy engine treats the assignment as authoritative.
Ruta de ataque
1. Discovery: with any domain-authenticated context, the attacker enumerates GPOs and their Software Installation entries. Get-GPO -All piped to Get-GPOReport -ReportType Xml, or PowerView Get-DomainGPO, exposes every package path. BloodHound surfaces GPOs linked to high-value OUs. 2. Source-path triage: for each MSI UNC, the attacker tests write access. net use \\fileserver\software, then dir and a write probe, or Find-InterestingDomainShareFile from PowerView, identifies shares where the current user has Modify on the MSI or on the parent folder. Shares hosted on workstations or decommissioned servers are common wins. 3. Payload preparation: the attacker builds a trojanized MSI. msfvenom -f msi, WiX with a custom action calling powershell.exe, or a wrapper that runs the original installer plus a payload. The malicious MSI keeps the same ProductCode so Windows Installer treats it as the same product and does not roll back targeted machines. 4. Replacement: the attacker overwrites the MSI on the share. No GPO change is needed, no SYSVOL replication is involved, no Event ID 5136 fires on the GPO object. 5. Execution: at the next gpupdate or reboot, the Group Policy Software Installation CSE detects that the assigned package needs to be installed (or re-installed if the version changed) and Windows Installer runs the MSI as SYSTEM on every targeted machine. For computer-assigned packages, this happens at boot before user logon, which defeats most user-mode EDR hooks. 6. Alternative path: if the attacker has GPO edit rights instead of share write rights, they create a new Software Installation entry in an existing GPO, pointing at an MSI on a share they control. SharpGPOAbuse and PowerView Set-DomainObject support this path. Linking to the Domain Controllers OU yields domain-wide SYSTEM. 7. Persistence: because the package is Assigned, the Group Policy engine reinstalls it if it is removed, until the GPO entry itself is deleted.
Cómo lo evalúa Guerrilla
Guerrilla loads the GroupPolicy and SmbShare modules, calls Get-GPO -All -Domain $env:USERDNSDOMAIN, then for each GPO calls Get-GPOReport -Guid $gpo.Id -ReportType Xml. The XML is parsed with [xml] cast and the check walks GPO.Computer.ExtensionData.Extension and GPO.User.ExtensionData.Extension looking for the Software Installation CSE GUID {c6dc5466-785a-11d2-84d0-00c04fb169f7}. For each MsiApplication node it extracts Name, Path, ProductCode, DeploymentType, and InstallationUiLevel. The UNC Path is split into server and share. The check resolves the server via Resolve-DnsName, opens the share via Get-SmbShareAccess (when run from a host with rights), reads the NTFS ACL via Get-Acl on \\server\share\path, and computes Get-FileHash -Algorithm SHA256 on the MSI. Get-AuthenticodeSignature returns SignerCertificate, Status, and StatusMessage. The MSI _SummaryInformation stream is read via the WindowsInstaller.Installer COM object (OpenDatabase, OpenView on _SummaryInformation, GetSummaryInformation) to extract Subject, Author, Title, and Template. Output rows include GpoName, GpoId, PackageName, PackagePath, ProductCode, DeploymentType, ShareAcl, NtfsAcl, Sha256, SignatureStatus, SignerSubject, Publisher, IsHighRisk (bool), and a Notes field that enumerates the specific failure reasons.
Valor recomendado
Todos los paquetes MSI desplegados por GPO provienen de ubicaciones seguras y con control de acceso, con integridad verificada
Remediación
Identifique todas las configuraciones de instalación de software en las GPO. Verifique que las rutas de origen de los MSI apunten a recursos compartidos protegidos con permisos NTFS y de recurso compartido apropiados. Confirme que los paquetes MSI provengan de proveedores de confianza y no hayan sido manipulados. Considere usar WDAC o AppLocker para restringir la instalación de MSI a los paquetes aprobados.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-5, CM-7(5), SI-7
- MITRE ATT&CK
- T1484.001, T1072