ADGPO-016: Revisión de seguridad de configuraciones de registro
- Plataforma
- Active Directory
- Categoría
- AD Group Policy
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las GPO pueden desplegar configuraciones de registro que afectan a las configuraciones de seguridad, incluidas la deshabilitación de funciones de seguridad, el debilitamiento de los protocolos de autenticación o la habilitación de servicios inseguros. Las configuraciones basadas en el registro de las GPO deben revisarse para asegurar que no debiliten la postura de seguridad de los sistemas de destino
Por qué importa
A registry value pushed by a GPO is not a local setting. It is a forest-wide change-management primitive that runs as SYSTEM on every machine in scope at the next group policy refresh (90 to 120 minutes by default, immediately on gpupdate /force). A single line in registry.pol that sets HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential to 1 re-enables WDigest plaintext credential caching on every workstation that receives the policy, handing the attacker cleartext passwords from LSASS at the next interactive logon. Setting HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL to 0 disables LSA protection and re-enables Mimikatz-class credential theft against lsass.exe. Setting EnableLUA to 0 disables User Account Control consent prompts for the local administrator token, allowing silent privilege elevation. Adding C:\ or C:\Windows\Temp to Windows Defender Exclusions\Paths neutralizes endpoint AV across the fleet. Setting LocalAccountTokenFilterPolicy to 1 enables remote pass-the-hash with local administrator accounts. Pushing a malicious Subsystems\Optional or Lsa\Notification Packages value loads an attacker-controlled DLL into LSASS at every boot, achieving forest-wide persistence (MITRE T1547.008 / T1547.005 Authentication Package). The blast radius is the OU tree the GPO is linked to: a single registry value in the Default Domain Policy applies to every domain-joined machine in the forest. Because the change is a small binary diff in registry.pol on SYSVOL, it is invisible to most file-integrity tooling and to administrators who never open GPMC to look at the Preferences or Administrative Templates branches of an unfamiliar GPO. ADGPO-016 is rated Medium because exploitation typically requires existing GPO edit rights, but the practical impact of a single weaponized value is forest-wide credential theft, EDR neutralization, or boot-persistent code execution.
Ruta de ataque
Step 1: GPO write primitive. The attacker obtains Edit settings, delete, modify security on at least one widely linked GPO. Common paths: BloodHound surfaces GenericWrite, GenericAll, WriteDacl, or WriteOwner edges on a groupPolicyContainer, an over-delegated help desk group, an OU-level Delegation of Control wizard grant of "Manage Group Policy links" combined with GPO edit rights, or membership in Group Policy Creator Owners on a GPO they originally created. Step 2: Target selection. The attacker enumerates Get-GPO -All, sorts by the number of linked OUs (Get-GPOReport returns LinksTo), and picks a high-link-count GPO that is unlikely to be reviewed (a generic naming convention like "Workstation Baseline" or "Standard User Settings"). A GPO linked to the Domain Controllers OU is preferred for forest takeover; a GPO linked to the domain root reaches every joined machine. Step 3: Payload selection. The attacker picks one or more registry values that map to a concrete objective. For credential theft: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential = 1 (re-enable WDigest), HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL = 0 (disable LSA protection). For EDR evasion: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableRealtimeMonitoring = 1 or Exclusions\Paths\C:\ = 0. For lateral movement: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = 1 (enable remote local-admin auth). For persistence: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages = <attacker DLL name> (loaded by LSASS at boot, T1547.005). Step 4: Deployment. The attacker uses the GroupPolicy module (Set-GPRegistryValue -Name "Workstation Baseline" -Key "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" -ValueName UseLogonCredential -Type DWord -Value 1) or writes directly to SYSVOL\<domain>\Policies\{GUID}\Machine\Registry.pol with a tool like SharpGPOAbuse, pyGPOAbuse, or a custom PReg writer. Group Policy Preferences Registry XML (Preferences\Registry\Registry.xml) is an alternate channel that adds an item-level targeting filter to limit scope (for example, only apply to machines where an EDR sensor is installed) and reduces the chance of breakage on unintended targets. Step 5: Replication and activation. SYSVOL replicates via DFS-R within minutes. Clients apply the registry change on the next group policy background refresh (90 to 120 minutes, randomized) or immediately on gpupdate /force. Many of the targeted values take effect on the next user logon (WDigest, LSA Notification Packages) or on the next service restart, which the attacker can force via Restart-Service or scheduled reboots. Step 6: Cleanup. The attacker can either leave the malicious value in place (most environments never review registry.pol contents) or revert it after harvesting credentials, leaving only a brief versionNumber increment and an event 5136 directory service change on the PDC emulator as forensic evidence.
Cómo lo evalúa Guerrilla
Guerrilla binds to each domain in the forest and enumerates (objectClass=groupPolicyContainer) under CN=Policies,CN=System. For each GPO it resolves gPCFileSysPath, walks \Machine and \User on SYSVOL, and parses every Registry.pol using the PReg binary format documented in MS-GPREG. Each record yields (hive, subkey, value name, REG_ type, data length, data bytes). The check then enumerates Preferences\Registry\Registry.xml under both sides and parses every <Registry> element for (Hive, Key, Name, Type, Value, status, removePolicy, action). Both result sets feed a pattern matcher: case-insensitive key-path prefix match against a curated rule set (LSA, WDigest, SMB signing, UAC, Defender, PowerShell logging, Winlogon AutoLogon, Terminal Server, Cryptography), and value-aware comparison (for example, UseLogonCredential = 1 is a violation, UseLogonCredential = 0 is compliant; RunAsPPL = 0 is a violation, RunAsPPL = 1 or 2 is compliant; any path under Defender Exclusions\Paths is flagged for review with severity weighted by how broad the path is). For each finding, the check captures the GPO displayName, GUID, gPLink targets resolved up the OU tree, nTSecurityDescriptor on the GPO (to identify which principals could modify it), versionNumber and whenChanged on the AD object (to indicate recency), and the literal key/value/data so the operator can immediately reproduce the finding in GPMC or with Get-GPRegistryValue.
Valor recomendado
Ninguna configuración de registro de GPO que debilite los valores predeterminados de seguridad; todas las modificaciones de registro documentadas y justificadas
Remediación
Exporte las configuraciones de registro de las GPO desde las Plantillas administrativas y las Preferencias de registro. Revise las configuraciones que afectan a claves de registro relevantes para la seguridad, incluidas HKLM\SYSTEM\CurrentControlSet\Control\Lsa, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies y las claves relacionadas con la autenticación. Elimine o corrija las configuraciones que debiliten la postura de seguridad.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- CM-6, CM-6(1)
- MITRE ATT&CK
- T1484.001, T1112