ADPRIV-002: Enterprise Admins Enumeration
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check binds to the forest root domain and reads the membership of CN=Enterprise Admins,CN=Users,DC=<forest-root> via LDAP, then expands the membership recursively. Specifically it evaluates: - The member attribute of the Enterprise Admins group (well-known SID S-1-5-21-<root-domain>-519). - Nested group members via the LDAP_MATCHING_RULE_IN_CHAIN (1.2.840.113556.1.4.1941) extended match filter, so a user who inherits Enterprise Admin rights through any depth of nesting is still reported. - Foreign security principals (objectClass foreignSecurityPrincipal) that resolve to accounts in trusted forests or domains. - The adminCount attribute on each resolved member (should be 1, indicating SDProp has stamped the AdminSDHolder ACL). - Account state: enabled / disabled, lastLogonTimestamp, pwdLastSet, userAccountControl flags (DONT_EXPIRE_PASSWORD, PASSWD_NOTREQD, TRUSTED_FOR_DELEGATION). - Whether the account is in the Protected Users group and whether it has an authentication policy / silo assignment. Any permanent, non-emergency member is a finding. The check is intentionally strict: even a single domain admin service account or a legacy migration account left behind is reported.
Por qué importa
Enterprise Admins is the highest-privilege group in the forest. Its members are automatically added to the local Administrators group on every domain controller in every domain in the forest at promotion time, and they hold the rights required to modify the Schema partition, the Configuration partition, create or delete domains, manage forest trusts, and authorize Enterprise Certificate Authorities into NTAuthCertificates. The forest is the security boundary in Active Directory: a compromise of Enterprise Admins is not recoverable through password resets, krbtgt rotation, or domain rebuilds, because the attacker can stamp persistent changes into the Configuration NC and Schema NC that propagate to every DC in every domain. Microsoft has documented for over a decade that this group should be empty during steady-state operations. Despite this, real-world assessments routinely find legacy administrators, service accounts, or break-glass identities permanently nested in Enterprise Admins, which presents a single point of failure for the entire identity perimeter. Ransomware crews and state-aligned operators specifically enumerate this group during reconnaissance because a single successful credential theft against an EA member ends the engagement.
Ruta de ataque
1. Reconnaissance: after gaining any authenticated foothold in the forest, the attacker enumerates Enterprise Admins membership with a single LDAP query (Get-ADGroupMember -Identity "Enterprise Admins" -Server <forest-root>, or BloodHound SharpHound -CollectionMethod Group,Trusts, or net group "Enterprise Admins" /domain). The query requires no special privilege: any authenticated user can read group membership by default. 2. Target selection: the attacker ranks the enumerated members by likelihood of compromise. Service accounts with SPNs are prioritized for Kerberoasting (T1558.003). Accounts not in Protected Users and without authentication policy silos are prioritized for credential theft via LSASS dumping on any host they touch. Accounts with DONT_EXPIRE_PASSWORD set or stale pwdLastSet timestamps are prioritized for password spray and offline cracking. 3. Credential capture: the attacker uses Rubeus (asktgs / kerberoast), mimikatz (sekurlsa::logonpasswords), Impacket (GetUserSPNs.py), or Responder for NTLMv2 capture to obtain credentials or hashes for the target EA member. 4. Forest takeover: with valid EA credentials, the attacker can: (a) run DCSync (T1003.006) against any DC in any domain to extract the krbtgt hash and forge Golden Tickets, (b) modify the Configuration NC to publish a rogue Enterprise CA into NTAuthCertificates and forge authentication certificates for any user (ESC5-class abuse), (c) modify the Schema partition to add a backdoor attribute or alter the default security descriptor of a class, (d) create or modify forest trusts to grant a controlled external forest SIDHistory authority via the SID filtering bypass. 5. Persistence: the attacker plants ACEs on AdminSDHolder, adds a controlled principal to the Configuration NC ACL, or installs a Skeleton Key on a DC. Each of these survives password rotation of the originally compromised EA account.
Cómo lo evalúa Guerrilla
Guerrilla resolves the forest root domain via Get-ADForest, locates the Enterprise Admins group by its well-known RID (519) under the root domain, and issues a single LDAP search using the LDAP_MATCHING_RULE_IN_CHAIN filter (member:1.2.840.113556.1.4.1941:=<group-DN>) to expand all direct and nested members in one round trip. For each returned principal the check pulls sAMAccountName, distinguishedName, objectClass, userAccountControl, adminCount, lastLogonTimestamp, pwdLastSet, servicePrincipalName, and memberOf. Foreign security principals are resolved to their source domain via the SID prefix. Results include account state and Protected Users / authentication policy assignment so triage can distinguish a hardened break-glass account from a forgotten legacy admin. The query is performed against the forest root PDC emulator to ensure the freshest membership view, and is read-only.
Valor recomendado
Empty during normal operations. Members added temporarily only for forest-level changes with documented approval
Remediación
Enumerate Enterprise Admins membership using Get-ADGroupMember -Identity 'Enterprise Admins' -Recursive. Remove all permanent members. Implement a just-in-time access process for forest-level operations that temporarily adds and removes members with full audit logging
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-6(5), AC-2(2)
- CIS Benchmark
- 9.2.2
- ANSSI
- R2
- CIS AD Benchmark
- 4.1.2
- MITRE ATT&CK
- T1078.002, T1069.002