ADGPO-019: Configuración del Firewall de Windows mediante GPO
- Plataforma
- Active Directory
- Categoría
- AD Group Policy
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las configuraciones del Firewall de Windows Defender con seguridad avanzada desplegadas mediante GPO controlan el acceso de red en los sistemas unidos al dominio. Las GPO que deshabilitan el firewall, permiten reglas de entrada demasiado permisivas o no configuran el firewall dejan los sistemas vulnerables al movimiento lateral y a los ataques basados en red
Por qué importa
The Windows Defender Firewall is the only host-resident control that consistently blocks the network primitives used by every post-exploitation framework: SMB (445) for PsExec, RemoteExec, and SMBexec; RPC (135 plus dynamic high ports) for WMI, DCOM, and the Service Control Manager; WinRM (5985/5986) for PowerShell Remoting and Evil-WinRM; and RDP (3389) for interactive lateral movement. When a GPO sets EnableFirewall = 0 on the Domain profile, every host in the linked OU accepts inbound connections to any listening service from any source on the corporate network, which is the canonical precondition for SMB lateral movement, NTLM relay against SMB and HTTP, PrintNightmare (MS-RPRN) reachability, PetitPotam (MS-EFSRPC) reachability, and RPC-based credential dumping (DRSUAPI for DCSync, comsvcs.dll for LSASS dump over admin shares). A GPO that leaves the firewall enabled but inserts an Allow inbound rule for "File and Printer Sharing (SMB-In)" with RemoteAddress=Any has the same operational effect as disabling the firewall for ransomware crews who already have one foothold. The MITRE Impair Defenses technique (T1562.004) explicitly enumerates firewall modification as a high-value preparatory step for adversaries with administrative rights, and the Group Policy Modification technique (T1484.001) is the persistent variant that survives GPP refresh and password rotations because the change lives in SYSVOL rather than on the endpoint. For domain controllers and Tier-0 servers, the blast radius is forest-wide: a DC with an open firewall is the canonical lateral-movement pivot for Golden Ticket use, DCSync, and DNSAdmin abuse.
Ruta de ataque
1. Reconnaissance: with any authenticated domain user, the attacker pulls every GPO and parses the firewall section of each. PowerView Get-DomainGPO returns the GPO list, Get-DomainGPOLocalGroup correlates GPOs to OUs, and a direct read of \\domain\SYSVOL\domain\Policies\{GUID}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf plus the registry.pol files returns the EnableFirewall and DefaultInboundAction values without privileged rights. 2. Identification of soft scopes: the attacker maps OUs where EnableFirewall = 0 or DefaultInboundAction = Allow. Workstation OUs with open firewalls are flagged as lateral-movement playgrounds; server OUs are flagged as service-abuse targets; the Domain Controllers OU with an open firewall is flagged as a Tier-0 pivot. 3. Foothold: from a single compromised endpoint, the attacker scans the OU for listening services. With SMB open, they enumerate shares with smbclient or crackmapexec smb. With RPC open, they enumerate via impacket rpcdump and rpcclient. With WinRM open, they spray credentials with crackmapexec winrm or Evil-WinRM. 4. Lateral movement: open SMB enables PsExec, Impacket smbexec, and pass-the-hash with crackmapexec. Open RPC enables wmiexec, dcomexec, and atexec. Open WinRM enables Invoke-Command and Evil-WinRM. None of these require touching the endpoint firewall because the GPO already left it open. 5. Coercion and relay: with SMB and RPC open on workstations and servers, the attacker triggers PetitPotam (MS-EFSRPC EfsRpcOpenFileRaw) or PrinterBug (MS-RPRN RpcRemoteFindFirstPrinterChangeNotificationEx) against any reachable host to coerce machine-account NTLM authentication, then relays the authentication to ADCS HTTP enrollment (ESC8) or to LDAP for Resource-Based Constrained Delegation. 6. Persistence via the same GPO: if the attacker also has GPO edit rights (delegated permission, Group Policy Creator Owners membership, or a writeable ACE on the GPO container), they tighten the rule to reference their own implant ports and call the change "hardening" so a defender reviewing the GPO history sees benign churn. 7. Evasion: when LogDroppedPackets is off (the default), there is no on-host evidence of the connection attempts that the firewall would otherwise have blocked. When AllowLocalPolicyMerge is on, the attacker with SYSTEM can add a local rule that survives across gpupdate cycles because the merge happens after policy refresh.
Cómo lo evalúa Guerrilla
Guerrilla loads the GroupPolicy module and enumerates every GPO with Get-GPO -All. For each GPO it parses two surfaces. First, it reads the registry-based firewall settings by mounting the GPO registry.pol files (\\$domain\SYSVOL\$domain\Policies\{$id}\Machine\registry.pol) and walking the keys under Software\Policies\Microsoft\WindowsFirewall\DomainProfile, \PrivateProfile, and \PublicProfile, recording EnableFirewall, DefaultInboundAction, DefaultOutboundAction, DisableNotifications, LogDroppedPackets, LogSuccessfulConnections, AllowLocalPolicyMerge, and AllowLocalIPsecPolicyMerge. Second, it parses the WFAS rule collection stored in the GPO under \Machine\Microsoft\Windows Firewall With Advanced Security and reads the FirewallRules and ConSecRules entries, then translates each rule string (Action, Direction, Protocol, LocalPort, RemoteAddress, RemoteUserAuthorizedList, Service, Profile, Enabled) into a structured object. Each rule is scored against an allowlist: Allow + Inbound + RemoteAddress=Any + a sensitive port set (135, 137-139, 445, 3389, 5985, 5986, 47001, 49152-65535) on the Domain or Public profile is the high-severity bucket. The check also enumerates linked SOMs via Get-ADOrganizationalUnit -LDAPFilter "(gPLink=*$id*)" plus the domain root and the Sites container, and cross-references the apply trustees so an inert GPO (no valid Apply principal per ADGPO-009) is downgraded to informational. Output rows include GpoName, GpoId, Profile, Setting (or RuleName), CurrentValue, RecommendedValue, LinkedScopes, AppliesToTier0 (bool), and Severity.
Valor recomendado
Firewall de Windows habilitado para todos los perfiles (Dominio, Privado, Público) con reglas de entrada de denegación por defecto configuradas mediante GPO
Remediación
Revise las configuraciones de GPO del Firewall de Windows en todas las GPO aplicables. Asegúrese de que el firewall esté habilitado para los perfiles Dominio, Privado y Público. Verifique que las reglas de entrada sigan un enfoque de denegación por defecto con reglas de permiso específicas solo para los servicios necesarios. Elimine cualquier configuración de GPO que deshabilite el Firewall de Windows. Pruebe las reglas del firewall en una OU de ensayo antes del despliegue en todo el dominio.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| informational | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SC-7, SC-7(5), CM-6
- MITRE ATT&CK
- T1484.001, T1562.004