ADPRIV-025: Computer Accounts in Privileged Groups
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check resolves every well-known privileged group by SID rather than by name (names can be localized or renamed) and recursively expands membership. Groups evaluated include: - Domain Admins (S-1-5-21-<domain>-512) - Enterprise Admins (S-1-5-21-<root>-519) - Schema Admins (S-1-5-21-<root>-518) - Administrators (S-1-5-32-544) - Account Operators (S-1-5-32-548) - Server Operators (S-1-5-32-549) - Backup Operators (S-1-5-32-551) - Print Operators (S-1-5-32-550) - DnsAdmins (resolved by name, default RID varies) - Cert Publishers, Group Policy Creator Owners, and any group marked adminCount=1 For each resolved member the check reads objectClass, sAMAccountName, distinguishedName, objectSid, dNSHostName, operatingSystem, userAccountControl (to surface TRUSTED_FOR_DELEGATION and TRUSTED_TO_AUTH_FOR_DELEGATION), and msDS-AllowedToActOnBehalfOfOtherIdentity. Any member whose objectClass is computer, msDS-GroupManagedServiceAccount, or msDS-ManagedServiceAccount is recorded as a finding. The expansion is recursive so a computer account nested inside a chain such as Domain Admins -> Legacy-Backup-Servers -> SRV-BACKUP01$ is still surfaced.
Por qué importa
A computer account is not a user. It is the identity under which every LocalSystem service on that host authenticates to the network. Placing the computer in Domain Admins gives the machine account, and therefore every service running as SYSTEM, the right to DCSync krbtgt, log on to any DC, modify GPOs linked to the Domain Controllers OU, and write to AdminSDHolder. The blast radius is the full domain, and the prerequisite for exploitation is the lowest possible bar: any code execution as SYSTEM on the host, or any technique that coerces the machine account into authenticating to an attacker-controlled relay. NTLM relay attacks against the machine account (PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce) become instant domain-takeover primitives instead of merely-bad relays. A Resource-Based Constrained Delegation attack against the computer object turns into Domain Admin impersonation. An attacker who compromises a single privileged-group computer can extract the machine-account password from LSA Secrets (mimikatz lsadump::secrets, secretsdump.py LOCAL), use it to request Kerberos tickets, and persist indefinitely without ever phishing a human. Backup and patch-management products that historically required Domain Admin (Veeam pre-9.5, Backup Exec, certain ConfigMgr deployment scenarios, legacy Altiris) are the most common source of this misconfiguration. Attacker-planted backdoors are the second.
Ruta de ataque
1. Discovery: from any authenticated context the attacker enumerates privileged groups (Get-ADGroupMember "Domain Admins" -Recursive, BloodHound SharpHound -CollectionMethod Group, or a single LDAP filter (&(objectClass=computer)(memberOf=CN=Domain Admins,...))). Computer-account members are immediately visible because Authenticated Users can read group membership by default. 2. Initial access on the privileged computer: the attacker reaches the host through any standard vector (unpatched service, exposed RDP, phishing payload landing on an interactive logon session, exploitation of a vulnerable backup agent, supply-chain compromise of management software). 3. Local privilege escalation to SYSTEM if not already there. On a server hosting backup or management software the path is usually trivial: the agent itself runs as SYSTEM and frequently exposes a named pipe or RPC endpoint reachable by Authenticated Users. 4. Machine-account abuse without LPE: even without SYSTEM the attacker can coerce the machine account to authenticate to a relay. PetitPotam (MS-EFSR), PrinterBug (MS-RPRN), DFSCoerce (MS-DFSNM), or ShadowCoerce (MS-FSRVP) trigger the computer to send NTLM or Kerberos to an attacker-controlled host. Because the computer is a Domain Admin, the relayed credential is a Domain Admin credential. ntlmrelayx -t ldaps://dc --escalate-user attacker or impacket-secretsdump dc$ then completes the domain takeover. 5. Machine-account credential extraction with SYSTEM: mimikatz lsadump::secrets, reg save HKLM\SECURITY then secretsdump.py LOCAL, or simply reading the cached TGT with Rubeus dump /service:krbtgt. The machine-account password (or NT hash) is then usable from any host on the network as the Domain Admin equivalent. 6. Persistence: with Domain Admin equivalence the attacker performs DCSync against krbtgt (mimikatz lsadump::dcsync /user:krbtgt or impacket-secretsdump), forges a Golden Ticket, and adds a backdoor ACE or hidden group member. The original computer membership can be removed by the defender without dislodging the attacker.
Cómo lo evalúa Guerrilla
Guerrilla resolves each privileged group by its well-known SID against the domain RootDSE, performs a paged LDAP search for the member attribute with range retrieval to handle groups larger than the MaxValRange limit, and recursively expands nested groups and foreign-security-principals in PowerShell rather than relying on -Recursive alone. For each resolved principal the objectClass attribute is inspected; any value of computer, msDS-GroupManagedServiceAccount, or msDS-ManagedServiceAccount produces a finding. The check additionally reads userAccountControl on the offending computer to surface compounding risk (TRUSTED_FOR_DELEGATION, TRUSTED_TO_AUTH_FOR_DELEGATION, WORKSTATION_TRUST_ACCOUNT versus SERVER_TRUST_ACCOUNT) and dNSHostName / operatingSystem so the operator can identify the physical host immediately. Queries are LDAP-only against any reachable writable DC and require no local RSAT module. The finding payload includes the group name, the group SID, the member DN, the member SID, the membership path (direct or via nested chain), and every attribute that contributes to the risk score.
Valor recomendado
No computer accounts in any privileged groups
Remediación
Enumerate privileged group members and identify any computer accounts using Get-ADGroupMember 'Domain Admins' | Where-Object {$_.objectClass -eq 'computer'}. Repeat for all privileged groups. Remove computer accounts immediately and investigate why they were added
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-2
- CIS AD Benchmark
- 4.6.3
- MITRE ATT&CK
- T1078.002