ADPATH-001: Escalation Paths to Tier-0
- Plataforma
- Active Directory
- Categoría
- Attack Paths
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Models non-default control over Tier-0 objects (the domain root, AdminSDHolder, the Domain Controllers OU, and the GPO / Configuration / Schema containers) as privilege-escalation PATHS and reports the concrete takeover technique each one enables. Any non-default principal holding GenericAll / WriteDacl / WriteOwner / replication rights over one of these objects is a one-hop path to Domain Admin equivalence. It also flags non-default groups nested inside a Tier-0 group as escalation pivots — controlling such a group, or being added to it, confers the Tier-0 group's privileges. Full domain-wide transitive control-chain computation (low-priv user through a chain of GenericWrite/AddMember edges to Domain Admins) requires full-domain ACL collection, which is a separate roadmap item.
Valor recomendado
No non-default principals have control over Tier-0 objects.
Remediación
For each reported path, remove the attacker-controllable ACE from the target object's DACL (Active Directory Users and Computers > Advanced Security, or Set-Acl), or remove the principal from whatever group grants it. Only Tier-0 administrators should hold GenericAll/WriteDacl/WriteOwner or replication rights on the domain root, AdminSDHolder, the Domain Controllers OU, and the Policies/Configuration/Schema containers.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-5, AC-6
- MITRE ATT&CK
- T1098, T1222.001, T1484.001