ADLOG-001: Directiva de auditoría avanzada configurada
- Plataforma
- Active Directory
- Categoría
- AD Logging & EDR Posture
- Severidad
- High
- Pilar de Zero Trust
- Visibility & Analytics (peso 2)
- Fixtures de referencia
- 1
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
La antigua directiva de auditoría de nueve categorías es demasiado imprecisa para las investigaciones modernas: puede indicarte que ALGO falló en 'Auditar eventos de inicio de sesión de cuenta', pero no si fue un error de preautenticación de Kerberos, una solicitud de vale de servicio o un paso de credenciales explícito. Windows admite la directiva de auditoría avanzada (más de 60 subcategorías) desde Vista, pero hay que habilitarla de forma expresa. La presencia de audit.csv en la carpeta SYSVOL de la Default Domain Controllers Policy es el indicador observable de que el dominio ha migrado.
Por qué importa
Without subcategory-level auditing, the Security log on a Domain Controller cannot distinguish a Kerberos service ticket request (Event ID 4769, the primary Kerberoasting indicator) from a credential validation (4776) from a Kerberos AS-REQ (4768). The legacy "Audit account logon events" category lumps all of these together and the analyst loses the ability to write detections for: Kerberoasting (4769 with ticket encryption type 0x17 RC4-HMAC), AS-REP roasting (4768 where Pre-Authentication Type 0 was used), DCSync (4662 with the DS-Replication-Get-Changes-All control access right GUID), Golden Ticket reuse (4769 with no preceding 4768 for the same TGT), Silver Ticket abuse (4624 on a service host with no corresponding 4769 on a DC), Skeleton Key (LSASS DLL injection signals in 4673 / 4674), DCShadow (Directory Service Changes), and password-spraying patterns. Operationally this is the difference between a SOC that can investigate an authentication anomaly in minutes and one that has to pull a memory image of LSASS to answer the same question. Compliance frameworks treat the advanced policy as the baseline: CIS Microsoft Windows Server 2022 benchmark section 17, NIST 800-53 AU-2 / AU-3 / AU-12, PCI DSS Requirement 10, and the Microsoft Security Compliance Toolkit baselines all assume subcategory-level configuration. Finally, attackers actively exploit log gaps: MITRE ATT&CK T1562.002 (Impair Defenses: Disable Windows Event Logging) is a documented technique used by APT41, FIN8, and Lazarus, and they target environments where audit policy is already weak because their tampering blends in with the existing noise floor.
Ruta de ataque
1. Initial recon: the operator lands on a member server with a low-privilege account and queries the effective audit policy with "auditpol /get /category:*". On a domain with ADLOG-001 failing, the output shows the nine legacy categories rather than the 60+ subcategories. This tells the operator that DC-side telemetry is coarse and that high-signal techniques will likely go undetected. 2. Kerberoasting (T1558.003): the operator requests TGS tickets for every account with a registered SPN using Rubeus kerberoast or Impacket GetUserSPNs.py. Each request emits Event 4769 on a DC, but without the Account Logon > Kerberos Service Ticket Operations subcategory enabled with Success auditing, the legacy "Audit account logon events" either does not produce these events or produces them without the ticket encryption type field, which is the load-bearing indicator (RC4-HMAC TGS for a user account is the canonical kerberoasting signature). 3. AS-REP roasting (T1558.004): the operator queries for accounts with DONT_REQ_PREAUTH set on userAccountControl and requests AS-REP responses without preauthentication using Rubeus asreproast. Without subcategory-level Kerberos Authentication Service auditing, the Pre-Authentication Type 0 field on Event 4768 is not reliably emitted. 4. DCSync (T1003.006): with appropriate replication rights the operator runs mimikatz lsadump::dcsync or secretsdump.py. The detection signature is Event 4662 on the Domain naming context with the DS-Replication-Get-Changes-All extended right GUID (1131f6ad-9c07-11d1-f79f-00c04fc2dcd2). Without DS Access > Directory Service Access subcategory auditing enabled, 4662 is not produced. 5. Log tampering (T1562.002, T1070.001): once persistence is established the operator can disable specific subcategories with auditpol /set, clear the Security log, or stop the EventLog service. Because the baseline was already coarse, the operations team does not detect the change. 6. Persistence and exfiltration proceed under cover of the logging gap. Post-incident, responders cannot reconstruct the attacker timeline from the Security log because the events they need (4769 with encryption type, 4662 with control access rights, 4673 sensitive privilege use) were never recorded.
Cómo lo evalúa Guerrilla
Guerrilla resolves the SYSVOL path for the current domain (\\<domain FQDN>\SYSVOL\<domain FQDN>\Policies) and constructs the canonical path for the Default Domain Controllers Policy using its well-known GUID {6AC1786C-016F-11D2-945F-00C04FB984F9}. It then tests for the presence of Machine\Microsoft\Windows NT\Audit\audit.csv inside that GPO folder. The check uses a SYSVOL read rather than parsing the GPO over LDAP because audit policy is not stored as attributes on the GPC object: the Group Policy Client-Side Extension for Advanced Audit Policy is a file-based CSE that reads the CSV at apply time. The check additionally reads the GptTmpl.inf to detect whether "Audit: Force audit policy subcategory settings" (registry path HKLM\System\CurrentControlSet\Control\Lsa, value SCENoApplyLegacyAuditPolicy) is set to 1, because without that flag the legacy category settings take precedence and the advanced subcategories are silently ignored. The check is read-only and runs as any authenticated domain user (SYSVOL is world-readable by Authenticated Users by default). Output emits the policy path inspected, a Boolean for audit.csv presence, a Boolean for the force-subcategory flag, and a parsed enumeration of the subcategories declared in the CSV when present, so downstream checks (ADLOG-002 through ADLOG-007) can validate which specific subcategories and Success / Failure settings are configured.
Valor recomendado
La Default Domain Controllers Policy incluye un audit.csv (Configuración del equipo > Directivas > Configuración de Windows > Configuración de seguridad > Configuración de directiva de auditoría avanzada > Directivas de auditoría > <subcategorías>).
Remediación
Abre la Default Domain Controllers Policy en GPMC. Ve a Configuración del equipo > Directivas > Configuración de Windows > Configuración de seguridad > Configuración de directiva de auditoría avanzada > Directivas de auditoría. Habilita como mínimo: Inicio de sesión de cuenta > Operaciones de vale de servicio Kerberos (Correcto+Erróneo), Inicio y cierre de sesión > Inicio de sesión (Correcto+Erróneo) + Inicio de sesión especial (Correcto), Administración de cuentas > todo (Correcto), Acceso a objetos > Recurso compartido de archivos + Recurso compartido de archivos detallado (Correcto+Erróneo si se supervisa el movimiento lateral), Seguimiento detallado > Creación de procesos (Correcto). Habilita también 'Auditoría: forzar la configuración de subcategorías de directiva de auditoría' en Opciones de seguridad para que tenga prioridad sobre la antigua configuración de nueve categorías.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AU-2, AU-3, AU-12
- CIS AD Benchmark
- 9.1.1
- MITRE ATT&CK
- T1562.002