ADPRIV-001: Enumeración de Domain Admins
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El grupo Domain Admins proporciona control administrativo total sobre todos los sistemas unidos al dominio. La pertenencia debe limitarse de forma estricta y cada miembro debe tener una justificación de negocio documentada. Una pertenencia excesiva incrementa drásticamente la superficie de ataque para el robo de credenciales y el movimiento lateral
Por qué importa
Domain Admins is one of the three groups (with Enterprise Admins and Schema Admins) that sits at Tier 0 of the Microsoft administrative tier model. Any credential theft event that yields a Domain Admin token, hash, or Kerberos ticket is, by definition, a full-domain compromise: the holder can DCSync krbtgt, forge Golden Tickets, modify GPOs linked to the Domain Controllers OU, and persist indefinitely. Every additional member multiplies the attack surface in two ways. First, it adds another endpoint, mailbox, and browser session where a phishing payload or info-stealer can land a Tier-0 credential. Second, it adds another account that may be assigned an SPN, marked TRUSTED_FOR_DELEGATION, or left with a static password, each of which converts directly into a domain-takeover primitive. Mandiant and Microsoft Incident Response have repeatedly attributed major ransomware incidents (Ryuk, Conti, BlackCat, LockBit) to the simple fact that the victim ran ten, twenty, or fifty Domain Admins, of which one was reachable from a workstation. The Microsoft guidance is unambiguous: Domain Admins should contain only the break-glass account during steady-state operation, with named admins added temporarily through a privileged access workstation.
Ruta de ataque
1. Enumeration: from any authenticated context the attacker queries Domain Admins with a single LDAP call (Get-ADGroupMember "Domain Admins" -Recursive, net group "Domain Admins" /domain, or BloodHound SharpHound -CollectionMethod Group,Session). The group is readable by Authenticated Users by default. 2. Target selection: the attacker cross-references members against session data (BloodHound HasSession edges, qwinsta, Get-NetSession) to find a Domain Admin whose token is currently cached on a Tier-1 or Tier-2 host the attacker already controls. 3. SPN abuse, if any DA carries a servicePrincipalName: the attacker requests a service ticket (Rubeus kerberoast /user:<DA>) and cracks the resulting TGS offline. A Kerberoastable DA is the fastest known path from a low-privilege user to Domain Admin and requires no exploit, only LDAP read and KRB_TGS_REQ. 4. Token or hash theft: with code execution on a host where the DA has logged on, the attacker dumps LSASS (mimikatz sekurlsa::logonpasswords, comsvcs.dll MiniDump, nanodump) or steals the Kerberos TGT (Rubeus dump /service:krbtgt) and reuses it via pass-the-hash or pass-the-ticket. 5. Persistence: once the attacker authenticates as a Domain Admin, they run DCSync (mimikatz lsadump::dcsync /user:krbtgt or impacket-secretsdump) to extract krbtgt and forge Golden Tickets, then add a backdoor ACE to AdminSDHolder or a hidden member to Domain Admins itself. 6. Cleanup: the attacker rotates the original DA credential to suppress detection, leaving the krbtgt-derived Golden Ticket as the persistent path.
Cómo lo evalúa Guerrilla
Guerrilla binds to a writable DC, resolves the domain SID, and reads the group at S-1-5-21-<domain>-512 via Get-ADGroup with -Properties member, member;range, and msDS-MembersOfGroupTransitive where available. Membership is expanded recursively in PowerShell rather than relying on -Recursive alone, so nested foreign-security-principals from trusted domains and tombstoned references are surfaced rather than silently dropped. For every resolved member the check pulls the supporting attributes (userAccountControl, pwdLastSet, lastLogonTimestamp, servicePrincipalName, adminCount, memberOf) in a single LDAP call to minimise round trips. The Protected Users membership lookup is performed against the Protected Users SID (S-1-5-21-<domain>-525). All queries are LDAP-only so the check works against any reachable DC and does not require RSAT loaded locally. Findings are emitted with the member DN, the path used to reach the group (direct or via nested group chain), and every attribute that contributes to the risk score so an analyst can triage without re-querying AD.
Valor recomendado
Pertenencia mínima (idealmente un máximo de 2-3 cuentas) con justificación documentada para cada miembro. Ninguna cuenta de usuario de uso diario
Remediación
Enumere la pertenencia a Domain Admins, incluidos los grupos anidados, con Get-ADGroupMember -Identity 'Domain Admins' -Recursive. Revise la necesidad de negocio de cada miembro. Elimine los miembros innecesarios y migre a modelos de administración delegada. Asegúrese de que ninguna cuenta de usuario normal sea miembro
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-6(5), AC-2(7)
- CIS Benchmark
- 9.2.1
- ANSSI
- R2
- CIS AD Benchmark
- 4.1.1
- MITRE ATT&CK
- T1078.002, T1069.002