ADPRIV-009: Análisis de pertenencia a grupos anidados
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las pertenencias a grupos anidados pueden ocultar los privilegios efectivos al esconder el acceso privilegiado tras cadenas de anidamiento de grupos. Los usuarios pueden tener acceso equivalente a Domain Admin a través de grupos anidados en profundidad que no son visibles mediante una simple enumeración de grupos
Por qué importa
Nested groups are the single most common reason a published Domain Admins membership list understates the true Tier-0 population. A typical pattern: a Help Desk team is nested into Server Operators for a one-off task in 2014, Server Operators is nested into Administrators by default, Administrators on a domain controller is equivalent to Domain Admins for most practical attack purposes, and seven years later the Help Desk group has 200 members who all hold logon rights on every DC. None of those 200 users appear in net group "Domain Admins" /domain, so the access goes unnoticed in every quarterly access review. BloodHound was built specifically to expose this class of indirect privilege: its Shortest Path to Domain Admins query traverses MemberOf edges transitively and routinely surfaces multi-hop paths that the defender did not know existed. Attackers exploit nesting because it gives them low-friction targets: a phishing payload against a Help Desk technician is far easier than a payload against a named Domain Admin, and the resulting access is identical. Circular nesting (group A contains group B contains group A) compounds the problem by making any audit tool that does not detect cycles loop forever or quietly truncate, hiding the true membership behind a parse failure rather than a finding.
Ruta de ataque
1. Collection: from any authenticated user context the attacker runs SharpHound (SharpHound.exe -c Group,LocalAdmin,Session,Trusts,ACL) or BloodHound.py to ingest every group, every membership edge, and every session. The collector resolves MemberOf transitively and stores the result as a Neo4j graph. 2. Path discovery: in the BloodHound UI the attacker runs Shortest Path to Domain Admins from the currently owned principal, or the broader Find Principals with DCSync Rights query. The graph returns every multi-hop nesting path, including the nested-group chain that grants the indirect privilege. 3. Target prioritisation: the attacker filters the resulting paths by exploitability, preferring paths that traverse populated groups (a 200-member Help Desk group is far easier to phish than a 2-member Tier-0 group) and paths that include weakly defended principals (kerberoastable accounts, unconstrained delegation hosts, users with stale passwords). 4. Pivot: the attacker compromises any leaf principal in the chosen path through phishing, password spray, Kerberoasting, or AS-REP roasting. Because the privilege is granted transitively, no membership change is required on the attacker side. 5. Privilege exercise: once the attacker authenticates as the compromised leaf, Windows resolves the full transitive group membership during logon (Kerberos PAC or NTLM token build) and stamps the privileged SIDs into the access token. The attacker then performs DCSync, GPO modification, or direct DC logon as if they had been added to Domain Admins directly. 6. Persistence: the attacker adds themselves or a backdoor account to a deeply nested group several hops from Tier-0, betting that the defender will only audit the top-level privileged groups and miss the indirect path.
Cómo lo evalúa Guerrilla
Guerrilla binds to a writable DC and, for each privileged group in the curated list, issues an LDAP search with the constructed attribute msDS-MembersOfGroupTransitive requested explicitly. Where the DC supports the constructed attribute, the result is the flattened transitive membership in one round trip. Where it does not (older functional levels or filtered DCs), the check falls back to a depth-first recursive walk in PowerShell that maintains a visited-set keyed by objectSid to detect and break cycles. For every leaf the check records the full chain of group DNs traversed from the privileged parent to the leaf, the nesting depth, the objectClass at every hop, and a flag for any cycle observed. Foreign-security-principals are resolved through the corresponding trust where the trust direction permits; unresolved FSPs are emitted with their raw SID and the trusted-domain SID prefix so the analyst can identify the source domain. SID history is read in the same LDAP call and any SID matching a known privileged group SID is flagged as a transitive grant outside the normal MemberOf graph. The findings are emitted as one row per (privileged group, leaf principal) pair with the path as a delimited string so the output can be filtered and pivoted in Excel or imported into BloodHound as a custom edge set.
Valor recomendado
Todas las rutas de grupos anidados hacia grupos privilegiados documentadas. Profundidad máxima de anidamiento de 2 niveles. Sin anidamiento circular
Remediación
Enumere de forma recursiva todas las pertenencias a grupos privilegiados con Get-ADGroupMember -Recursive. Mapee todas las rutas de anidamiento e identifique a los usuarios que obtienen privilegios mediante pertenencia indirecta. Aplane el anidamiento innecesario y documente todas las rutas anidadas restantes con justificación de negocio
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-2
- ANSSI
- R4
- CIS AD Benchmark
- 4.2.1
- MITRE ATT&CK
- T1069.002, T1078.002