ADPATH-002: Transitive Escalation Chains to Tier-0
- Plataforma
- Active Directory
- Categoría
- Attack Paths
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Computes MULTI-HOP privilege-escalation chains to Tier-0 by transitively following control (GenericAll / WriteDacl / WriteOwner / AddMember) and group-membership edges — for example HelpDesk --[WriteDacl]--> CORP-Admins --[MemberOf]--> Domain Admins. Complements ADPATH-001 (single-hop) by chaining edges of arbitrary length and reporting the shortest path per principal. Chain DEPTH is bounded by ACL-collection coverage: with the current six-critical-object collection most chains are one hop, so this check is typically clean today; the full-domain ACL collector (roadmap, live-gated) populates control edges over arbitrary objects and unlocks deep low-privilege-to-Domain-Admin chains. The engine itself chains arbitrary depth (BFS shortest-path, cycle-safe).
Valor recomendado
No transitive control chain leads a non-privileged principal to Tier-0.
Remediación
For each chain, break the weakest link: remove the attacker-controllable ACE at the first hop (the non-privileged principal's control over the next object in the chain), or remove the nested group from the Tier-0 group. Re-run to confirm the chain is severed.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-5, AC-6
- MITRE ATT&CK
- T1098, T1222.001, T1484.001