ADPRIV-020: Auditoría de objetos protegidos por AdminSDHolder
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
AdminSDHolder es un mecanismo de seguridad que sobrescribe las ACL de los objetos protegidos (usuarios y grupos privilegiados) cada 60 minutos mediante SDProp. Las modificaciones a la ACL de AdminSDHolder se propagan a todos los objetos protegidos, lo que lo convierte en un objetivo de alto valor para la persistencia. Las ACE no autorizadas en AdminSDHolder conceden acceso de puerta trasera a todas las cuentas privilegiadas
Por qué importa
AdminSDHolder is one of the highest-value persistence primitives in Active Directory. Write access to its DACL is functionally equivalent to permanent Domain Admin. SDProp (the Security Descriptor Propagator thread on the PDC emulator) re-copies the AdminSDHolder DACL onto every protected object on an hourly cycle, overwriting any defender remediation. An ACE planted on AdminSDHolder propagates within 60 minutes to Domain Admins, Enterprise Admins, Schema Admins, Administrators, Backup Operators, Print Operators, Server Operators, Account Operators, Replicator, Domain Controllers, Read-only Domain Controllers, Enterprise Read-only Domain Controllers, the Administrator account, and krbtgt. The attacker can then reset krbtgt to forge Golden Tickets, DCSync any account, and re-enter the environment at will. Because the ACE is re-applied every cycle, defenders who only clean up the protected groups (without cleaning AdminSDHolder itself) will see the attacker right come back automatically. This technique was first documented publicly by Sean Metcalf in 2015 and remains in the playbook of every mature adversary group, including the actors tracked by Mandiant as APT29 and the various ransomware affiliates that intrude via privilege escalation.
Ruta de ataque
1. Initial recon: the attacker enumerates AD ACLs with BloodHound (SharpHound -CollectionMethod ACL,DCOnly) or PowerView (Get-DomainObjectAcl -SearchBase "CN=AdminSDHolder,CN=System,DC=corp,DC=tld" -ResolveGUIDs). 2. Edge discovery: BloodHound surfaces a GenericAll, WriteDacl, WriteOwner, or AllExtendedRights edge from a compromised principal to the AdminSDHolder object. Common paths are over-delegated helpdesk groups, legacy service accounts with stale rights, or nested membership through an Exchange or Server Operators group. 3. ACE plant: with WriteDacl rights, the attacker adds an ACE granting their controlled principal FullControl. Example with PowerView: Add-DomainObjectAcl -TargetIdentity "CN=AdminSDHolder,CN=System,DC=corp,DC=tld" -PrincipalIdentity attacker -Rights All. Equivalent with dsacls: dsacls "CN=AdminSDHolder,..." /G attacker:GA. 4. Wait for SDProp: the PDC emulator runs SDProp every 60 minutes (registry value AdminSDProtectFrequency under HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters can change this, default is 3600 seconds). The attacker can force propagation immediately by writing FixUpInheritance = Yes to the RootDSE. 5. Persistence achieved: the ACE now exists on Domain Admins, Enterprise Admins, krbtgt, and every other protected object. The attacker can reset krbtgt twice for a Golden Ticket, run DCSync (mimikatz lsadump::dcsync, secretsdump.py), or add themselves to Domain Admins at any future date without needing the original compromised account. 6. Stealth refinement: the attacker may bury the ACE under inheritance flags, use a SID that no longer resolves to a name (orphaned SID), or use Dangerous Variant 2 from the SpecterOps ACE Up The Sleeve paper (a tightly-scoped ACE on a single inherited object type that does not show up in default DACL views). Some operators clear adminCount = 0 on accounts to remove them from the protected set after they finish, which itself is a detectable anomaly.
Cómo lo evalúa Guerrilla
Guerrilla resolves the AdminSDHolder DN by appending CN=AdminSDHolder,CN=System, to the current Get-ADDomain.DistinguishedName and reads nTSecurityDescriptor via Get-ADObject -Properties nTSecurityDescriptor. The DACL is walked through the .NET ActiveDirectorySecurity.Access collection. Each ACE is normalized (IdentityReference resolved via SecurityIdentifier.Translate), classified as inherited / explicit, and compared against an embedded baseline of default trustees and rights. ObjectType GUIDs are mapped to their semantic names (User-Force-Change-Password, DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, Self-Membership) using the schema GUID catalog. The check also reads the dSHeuristics attribute and the AdminSDProtectFrequency registry value (best-effort, requires remote registry) so any tampering with the SDProp cadence or the protected-group set is reported alongside the DACL findings. The check uses pure LDAP and does not require the AD PSDrive, so it works against any reachable DC, including DCs in domains where RSAT is not installed locally. Findings include the DN, trustee, rights mask, AccessControlType, IsInherited flag, and the resolved ObjectType GUID so a triage analyst can map each ACE back to its concrete capability.
Valor recomendado
La ACL de AdminSDHolder contiene solo entradas predeterminadas, sin ACE no autorizadas o inesperadas
Remediación
Revise la ACL de AdminSDHolder en CN=AdminSDHolder,CN=System,DC=domain mediante Get-ACL o ADSIEdit. Compárela con la línea base documentada. Elimine de inmediato cualquier ACE no predeterminada. Supervise las modificaciones a AdminSDHolder como parte de la supervisión de seguridad continua
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| no-data | Not Assessed |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, AC-3, AU-6
- ANSSI
- R6
- CIS AD Benchmark
- 4.7.1
- MITRE ATT&CK
- T1222.001, T1078.002