ADPRIV-027: RDP de usuarios privilegiados en DC
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El acceso por Escritorio remoto a los controladores de dominio debe limitarse de forma estricta a los administradores de Tier Zero designados. Las sesiones RDP almacenan en caché credenciales que pueden recolectarse, y un acceso RDP excesivo aumenta la superficie de ataque para el robo de credenciales y el movimiento lateral hacia los controladores de dominio
Por qué importa
A Domain Controller is the authoritative store for every password hash, every Kerberos long-term key, and every certificate private key bound to a machine identity in the forest. Any interactive logon to a DC, including RDP, loads the logged-on user's credential material into LSASS on the DC and, by the same mechanism, exposes any previously cached Tier-0 credential on that DC to whoever holds SeDebugPrivilege on the box. RDP is the worst case of interactive logon because it persists the session, leaves a desktop, and almost always uses Network-level credential delegation that places a reusable TGT in memory. Granting RDP to a non-Tier-0 identity (a helpdesk group, a server-operations team, a monitoring service account) collapses the tier model: any compromise of that identity becomes a compromise of the DC, and any compromise of the DC is, by definition, a compromise of the forest. The blast radius is total. Mandiant and Microsoft Incident Response have repeatedly documented ransomware operators using a single over-permissioned Remote Desktop Users membership on a DC to pivot from a Tier-1 server breach into a krbtgt DCSync and a Golden Ticket within hours. The Microsoft Tier 0 guidance and the CIS Domain Controller benchmark both treat interactive logon to DCs as the highest-sensitivity right in the directory, second only to the SeBackupPrivilege and SeRestorePrivilege.
Ruta de ataque
1. Reconnaissance: from any authenticated context the attacker enumerates the Default Domain Controllers Policy and any GPO linked to the Domain Controllers OU. Tools: Get-GPOReport -All -ReportType Xml, BloodHound CanRDP edge collection (SharpHound -CollectionMethod LocalAdmin,RDP,DCOM,PSRemote), or a direct read of \\<domain>\SYSVOL\...\GptTmpl.inf. The attacker also enumerates Remote Desktop Users and Server Operators on each DC. 2. Target selection: the attacker identifies a non-Tier-0 principal that holds SeRemoteInteractiveLogonRight on a DC, either directly or through a nested group. Common findings include the helpdesk group, a server-administration group, a monitoring service account, or a legacy "DC-RDP-Admins" group created for a long-forgotten migration. 3. Credential acquisition: the attacker compromises the chosen principal using whatever path is cheapest in the environment. Kerberoasting (Rubeus kerberoast) against a non-Tier-0 service account is the most common; phishing or token theft from a helpdesk operator is second most common; abuse of an ACE on the group object (GenericWrite, WriteOwner) is third. 4. Interactive logon: the attacker establishes an RDP session to a DC from a host they control. With Network-level credential delegation enabled (the default), the session ships a reusable TGT to the DC and the attacker now has a Tier-0 shell on the DC itself. 5. Lateral escalation in LSASS: the attacker runs mimikatz sekurlsa::logonpasswords or a stealthier equivalent (nanodump, comsvcs.dll MiniDump) on the DC and harvests every cached Tier-0 credential currently in memory, including the krbtgt service ticket if a real domain admin has recently logged on. 6. Persistence: from the DC the attacker runs lsadump::dcsync /user:krbtgt, forges a Golden Ticket, adds a backdoor ACE to AdminSDHolder, and exits. The original non-Tier-0 RDP grant is left in place because it is the persistence mechanism.
Cómo lo evalúa Guerrilla
Guerrilla resolves the Domain Controllers OU, then enumerates every GPO linked to that OU (including blocked-inheritance overrides) and the Default Domain Controllers Policy by well-known GUID. For each GPO it parses MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf and extracts the [Privilege Rights] section, specifically SeRemoteInteractiveLogonRight and SeDenyRemoteInteractiveLogonRight. SID strings in the template are resolved against the domain (and trusted domains for foreign-security-principals) to recover friendly names and object classes. The check then expands every group on the right recursively in PowerShell to surface nested non-Tier-0 members. To validate the effective state rather than only the declared state, the check optionally invokes secedit /export against each reachable DC and compares the resolved local policy to the GPO declaration, flagging drift. Built-in group membership (Remote Desktop Users S-1-5-32-555, Server Operators S-1-5-32-549, Administrators S-1-5-32-544) is read on each DC using Get-CimInstance Win32_GroupUser scoped to the local SAM. All queries are LDAP and SMB read-only and do not require RSAT loaded locally. Findings are emitted with the principal DN, the GPO and link path that granted the right, the nesting chain, and whether the principal is Tier-0 or not.
Valor recomendado
Solo las cuentas administrativas de Tier Zero designadas tienen permitido el acceso RDP a los controladores de dominio. 'Permitir el inicio de sesión a través de Servicios de Escritorio remoto' restringido mediante GPO
Remediación
Configure mediante directiva de grupo aplicada a la OU de Domain Controllers: Configuración del equipo > Directivas > Configuración de Windows > Configuración de seguridad > Directivas locales > Asignación de derechos de usuario > 'Permitir el inicio de sesión a través de Servicios de Escritorio remoto' = solo Administradores. Considere usar Remote Credential Guard o el modo Restricted Admin para las sesiones RDP
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6(1), AC-3, AC-17
- CIS Benchmark
- 2.2.26
- ANSSI
- R7
- CIS AD Benchmark
- 4.10.2
- MITRE ATT&CK
- T1078.002, T1021.001