ADPRIV-030: Usuarios privilegiados fuera de Protected Users
- Plataforma
- Active Directory
- Categoría
- AD Privileged Account Security
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las cuentas privilegiadas que no son miembros del grupo Protected Users carecen de protecciones de autenticación reforzadas y siguen siendo vulnerables a técnicas de robo de credenciales, incluidas la retransmisión NTLM, el almacenamiento en caché de credenciales y los tickets de Kerberos de larga duración. Toda cuenta privilegiada elegible debe estar protegida
Por qué importa
Every credential-theft technique that has driven the last decade of AD compromise relies on a primitive that Protected Users removes. Mimikatz sekurlsa::logonpasswords extracts cached NT hashes, Kerberos long-term keys, and WDigest plaintext from LSASS; for a Protected User the only artifact in memory after initial TGT acquisition is the TGT session key, and only for the 240-minute lifetime. NTLM relay against SMB, LDAP, HTTP (ADCS Web Enrollment, EWS, ADFS), and RPC requires the victim account to be able to authenticate over NTLM at all; a Protected User cannot, and the DC logs event 100 in Microsoft-Windows-Authentication/ProtectedUserFailures-DomainController for the attempt. Kerberoasting and AS-REP roasting against a Protected User return only AES-encrypted tickets, raising the offline cracking cost from commodity GPU-hours to economically infeasible. Unconstrained-delegation abuse (printer bug, PetitPotam coerce-and-relay against ADCS, S4U2Self-then-S4U2Proxy chains) cannot impersonate a Protected User because the DC will not issue a forwardable TGT for them and will not honor any S4U request that targets them. Pass-the-hash and overpass-the-hash are dead for Protected Users because no NT hash and no RC4 long-term key exist in cacheable form on the client. The blast radius of leaving a Domain Admin out of Protected Users is the entire forest: a single workstation foothold where that admin has ever logged on interactively, or a single relay opportunity against a service they authenticate to, hands the attacker their credential. The blast radius of placing them in Protected Users is, conservatively, the cost of one round of compatibility testing and a 240-minute reauthentication every four hours.
Ruta de ataque
1. Foothold and harvest. The attacker compromises a workstation or member server where a privileged human account has recently logged on (RDP, RunAs, Enter-PSSession). They run Mimikatz sekurlsa::logonpasswords or its modern equivalent (Nanodump, Dumpert, or a stealthy MiniDumpWriteDump variant against lsass.exe) and extract NT hashes, Kerberos AES and RC4 long-term keys, WDigest plaintext (if UseLogonCredential is set), and any cached TGT. For a non-Protected User every one of these is present and reusable; for a Protected User only the TGT session key is, and only for the remaining ticket lifetime. 2. Lateral movement. With the NT hash the attacker performs pass-the-hash against SMB, WMI, or WinRM on any host the admin has rights to. With the RC4 long-term key they perform overpass-the-hash to mint a new TGT (Rubeus asktgt /user:admin /rc4:<hash> /opsec) and then access any service in the domain. Neither primitive exists for a Protected User. 3. NTLM relay. The attacker positions an NTLM relay (ntlmrelayx, Inveigh, Responder with multi-relay) and coerces the privileged account to authenticate. Coercion vectors include MS-RPRN printer bug, PetitPotam MS-EFSRPC, MS-DFSNM, MS-FSRVP, and Outlook ICS calendar pull. For a non-Protected User the inbound NTLM auth is relayed to LDAP (to add the attacker to Domain Admins), to LDAPS (to delegate WriteDACL on the domain object), to ADCS Web Enrollment (to issue a client-auth certificate as the victim, then PKINIT for a persistent TGT), or to SMB on a target host. For a Protected User the DC rejects the NTLM exchange outright and writes event 100, no relay completes. 4. Kerberoast and AS-REP roast. The attacker requests a service ticket for any SPN-bound account the privileged user owns, or requests AS-REPs for accounts with DONT_REQUIRE_PREAUTH set. For a non-Protected User the ticket may be encrypted with the RC4 long-term key (etype 23), which hashcat mode 13100 cracks at multi-billion guesses per second on commodity hardware. For a Protected User the DC will only issue AES-encrypted tickets (etype 17 or 18), raising the cracking cost by orders of magnitude. 5. Delegation abuse. The attacker compromises a server trusted for delegation (constrained or unconstrained) and uses S4U2Self plus S4U2Proxy to impersonate the privileged user to a back-end service, or coerces the privileged user to authenticate to the trusted server to capture a forwardable TGT. For a Protected User the DC sets the TGT non-forwardable and refuses S4U2Self where the target is a Protected User, breaking the chain. 6. Persistence. The attacker who briefly held the credential plants a golden ticket, a silver ticket, a skeleton key, or a DSRM backdoor. None of these require Protected Users to be bypassed once initial credential theft has succeeded, which is why the entire delta between Protected Users membership and non-membership is the initial-theft surface in steps 1 through 5.
Cómo lo evalúa Guerrilla
Guerrilla queries the directory via LDAP and resolves the protected-group membership set by walking each well-known SID (rather than the CN, which can be renamed). For each member it issues a tokenGroups expansion against the user object to capture nested membership through any path. The Protected Users group is resolved separately by S-1-5-21-<domain>-525 and its transitive membership computed the same way. The check then computes A minus B and applies the eligibility filter: it drops objectClass msDS-GroupManagedServiceAccount and msDS-ManagedServiceAccount, drops any account with servicePrincipalName populated (service accounts must not be in Protected Users because the host always has the credential anyway), drops the built-in domain Administrator (RID 500, exempt by Kerberos design), drops krbtgt, and drops computer objects. For each remaining finding it pulls userAccountControl to surface SMARTCARD_REQUIRED (0x40000) and TRUSTED_FOR_DELEGATION (0x80000), pulls msDS-SupportedEncryptionTypes to confirm AES is available (0x18 or higher), pulls pwdLastSet to verify the password has been set since the domain reached 2008 functional level so AES keys exist, and reads the domain functional level (msDS-Behavior-Version on the domainDNS object: 5 = Windows Server 2012 R2, the minimum for Protected Users DC-side protections to apply). The check also reads the operational log Microsoft-Windows-Authentication/ProtectedUserSuccesses-DomainController (event 303) and ProtectedUserFailures-DomainController (events 100 and 104) from each DC where the log has been enabled, so the operator can correlate enrollment to actual KDC behavior.
Valor recomendado
Todas las cuentas de usuario privilegiadas elegibles inscritas en el grupo Protected Users. Excepciones documentadas con controles compensatorios
Remediación
Compare los miembros de los grupos privilegiados con la pertenencia a Protected Users. Para cada cuenta privilegiada que no esté en Protected Users, evalúe la compatibilidad (dependencias de NTLM, requisitos de delegación) y añádala al grupo. Documente cualquier excepción con motivos técnicos específicos y controles compensatorios
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, IA-5(2)
- ANSSI
- R5
- CIS AD Benchmark
- 4.12.2
- MITRE ATT&CK
- T1003, T1557, T1078.002