ADPRIV-017: Privileged Accounts Old Passwords
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check queries every account whose adminCount attribute equals 1 (set by SDProp on direct or transitive members of AdminSDHolder-protected groups) and every account that is a direct or nested member of the canonical Tier-0 groups, resolved by well-known SID rather than name. The targeted groups include: - Domain Admins (S-1-5-21-domain-512) - Enterprise Admins (S-1-5-21-root-519) - Schema Admins (S-1-5-21-root-518) - Administrators (S-1-5-32-544) - Account Operators (S-1-5-32-548) - Backup Operators (S-1-5-32-551) - Server Operators (S-1-5-32-549) - Print Operators (S-1-5-32-550) - Key Admins, Enterprise Key Admins, DnsAdmins, Cert Publishers For each resolved principal the check reads pwdLastSet, lastLogonTimestamp, userAccountControl (to test DONT_EXPIRE_PASSWORD and PASSWORD_NOTREQD), servicePrincipalName, and msDS-KeyVersionNumber. pwdLastSet is converted from a Windows FILETIME to a UTC DateTime and compared against (Get-Date).AddDays(-90). A pwdLastSet of zero indicates the user must change their password at next logon and is recorded separately. Accounts with DONT_EXPIRE_PASSWORD set are flagged regardless of age because they are excluded from domain password policy expiration.
Por qué importa
Credential rotation is the only mechanism that invalidates a stolen secret without account deletion. Privileged accounts are the highest-value targets in any AD environment, and a stale password on a Tier-0 identity defeats every downstream control: - Kerberoasted hashes for any privileged account with an SPN remain crackable offline against the current password. A four year old service account password cracked in 2026 still authenticates today. - Hashes extracted via DCSync (DRSUAPI GetNCChanges) or NTDS.dit theft remain valid for pass-the-hash and overpass-the-hash until the password is rotated. The KRBTGT account is the canonical example, but the same exposure applies to every privileged user. - LSASS memory captured by a successful Mimikatz run, by a backup of a privileged workstation, or by a crash dump uploaded to a third party telemetry pipeline yields cleartext or NTLM material that is reusable until rotation. - Password reuse on a personal SaaS account compromised in a credential stuffing dump exposes the corporate privileged identity for the lifetime of the unchanged password. Microsofts current guidance for human administrators is to use Just In Time (JIT) elevation via PIM or PAM rather than standing privilege, and to rotate any remaining standing-privilege passwords on a defined schedule. For service accounts the modern answer is Group Managed Service Accounts (gMSA / dMSA), which rotate automatically every 30 days by default and remove the human-managed password entirely. Any privileged account that does not fit one of those two models, and whose password is older than 90 days, represents an unmanaged credential lifetime that exceeds incident detection windows in most organizations.
Ruta de ataque
1. Initial credential capture: the attacker harvests material via any standard primitive. Kerberoasting (Rubeus kerberoast, Impacket GetUserSPNs) yields RC4 or AES service tickets encrypted with the target account NT hash; ASREProasting (Rubeus asreproast) targets accounts with DONT_REQ_PREAUTH; LSASS dumping (Mimikatz sekurlsa::logonpasswords, comsvcs.dll MiniDump) returns hashes from any privileged session on a compromised host; NTDS.dit theft via shadow copy or DCSync (Mimikatz lsadump::dcsync /user:CORP\admin) returns the krbtgt and per-user hashes. 2. Offline cracking: the attacker feeds harvested hashes into hashcat (-m 13100 for TGS-REP, -m 18200 for AS-REP, -m 1000 for NTLM) on rented GPU capacity. RC4 service tickets on a privileged account with a weak or long-unchanged password fall in hours. Even strong passwords become vulnerable as GPU economics improve over the lifetime of an unrotated credential. 3. Cold storage: cracked credentials are stored in the operators wordlist and tested periodically against the target environment. As long as pwdLastSet has not advanced past the date of compromise, the credential remains valid. 4. Reuse at the time of opportunity: months or years later, the attacker (or a buyer of the credential dump) replays the password against the targets RDP gateway, VPN, Exchange, or any service that accepts the privileged identity. Because the password has not been rotated, authentication succeeds with full administrative scope. 5. Persistence: with renewed access, the attacker establishes a longer-lived foothold (golden ticket via krbtgt, AdminSDHolder ACL backdoor, machine account takeover) and the cycle repeats.
Cómo lo evalúa Guerrilla
Guerrilla first builds the privileged-principal set by issuing a single LDAP query for (&(objectClass=user)(adminCount=1)) and unions the result with recursive expansion of the well-known Tier-0 group SIDs via tokenGroups and member;range. The union is deduplicated by objectSid. For each principal the cmdlet performs a single get of pwdLastSet, lastLogonTimestamp, userAccountControl, servicePrincipalName, msDS-UserPasswordExpiryTimeComputed, and whenChanged. pwdLastSet is interpreted as Int64 FILETIME and converted with [DateTime]::FromFileTimeUtc. The age threshold is 90 days for High severity, configurable via -PrivPasswordMaxAgeDays. Accounts with DONT_EXPIRE_PASSWORD (UAC bit 0x10000) set are appended to the finding regardless of age. krbtgt is evaluated against a separate 180-day rotation expectation (see ADKERB-001) but still reported here for visibility. Results are emitted with sAMAccountName, pwdLastSet (ISO-8601), days since rotation, UAC flag summary, SPN count, and the privileged group(s) that placed the account in scope.
Valor recomendado
All privileged account passwords changed within the last 60 days
Remediación
Identify privileged accounts with old passwords using Get-ADUser -Filter {AdminCount -eq 1} -Properties PasswordLastSet | Where-Object {$_.PasswordLastSet -lt (Get-Date).AddDays(-90)}. Force password rotation on all identified accounts. Implement FGPP with 60-day maximum password age for privileged accounts
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1)
- ANSSI
- R37
- CIS AD Benchmark
- 4.5.2
- MITRE ATT&CK
- T1078.002