ADPWD-013: Comprobación de contraseñas con diccionario personalizado
- Plataforma
- Active Directory
- Categoría
- AD Password & Lockout Policies
- Severidad
- Medium
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las contraseñas basadas en términos específicos de la organización (nombre de la empresa, nombres de productos, estaciones del año, nombres de ubicaciones) se usan con frecuencia y son fáciles de adivinar por atacantes dirigidos. Las comprobaciones con diccionario personalizado identifican contraseñas que cumplen los requisitos de complejidad pero siguen siendo predecibles
Por qué importa
Microsoft complexity is a per-character category test, not a strength test. Welcome01 has an uppercase letter, a lowercase letter, and a digit, satisfies complexity, satisfies an 8-character minimum, and is the single most-sprayed Windows password on the internet. Contoso2026!, Summer2025!, and Q1-Q4 quarter passwords pass every default control yet show up at the top of every cracked-hash dump. The exposure has three layers: 1. External password spraying: an attacker with a username list (collected from LinkedIn, MX records, or unauthenticated LDAP via ADIDNS) sprays a small custom wordlist against Entra ID, ADFS, OWA, or VPN endpoints. One match yields a domain-authenticated foothold. MITRE T1110.003. 2. Internal offline cracking: an attacker who reaches a Domain Controller or backup of NTDS.dit (T1003.003) cracks hashes offline. Organization-specific patterns are the first wordlist tried by every offensive operator because they recover the most hashes per CPU-second. 3. Privileged-account spray: service accounts, helpdesk accounts, and break-glass admins are frequently set with predictable passwords (Service2025!, Helpdesk!) and exempted from password expiry. A single match on a Tier-0 account is forest-takeover. Closing the gap requires a banned-list filter at password-set time (Azure AD Password Protection on-premises agent, or a third-party filter DLL). ADPWD-013 is the audit that proves the filter is needed and measures its effectiveness after deployment.
Ruta de ataque
1. Username enumeration: the attacker harvests samAccountName values from LinkedIn scraping, breached-credential databases, MX-record probing, or, on poorly hardened tenants, unauthenticated Entra ID enumeration (AADInternals Invoke-AADIntUserEnumerationAsOutsider). 2. Custom dictionary build: the attacker scrapes the targets website, annual report, and job postings for product names, office locations, mascot, and CEO surname. A small wordlist (50 to 500 base words) is generated and mangled with the same rules Guerrilla uses internally (capitalize, append year, append special character, season-year). 3. Low-and-slow spray: the attacker sprays one to three passwords per account per lockout window using MSOLSpray, TrevorSpray, or Kerbrute against Entra ID, ADFS, or KDC. Lockout thresholds are respected to avoid alarming the SOC. 4. Foothold: one in 50 to one in 200 accounts typically matches on the first round (industry baseline from SpecterOps, Mandiant, and Verizon DBIR). The attacker authenticates and enumerates the directory. 5. Privilege escalation: if a matched account is a Tier-1 admin or a service account with constrained delegation, the attacker pivots directly. Otherwise the attacker uses the foothold to dump NTDS.dit (via DCSync if the account has replication rights, or via a DC compromise chain) and runs the same custom dictionary offline against every NT hash. Hashcat with -a 0 -m 1000 against a 500-word custom dictionary cracks tens of thousands of hashes in minutes on a single GPU. 6. Persistence: every cracked Tier-0 hash becomes a long-term credential because password rotation alone does not address the underlying pattern.
Cómo lo evalúa Guerrilla
Guerrilla executes Get-ADReplAccount -All -Server <DC> -NamingContext (Get-ADRootDSE).defaultNamingContext via the DSInternals module to stream NT hashes from a writable Domain Controller. The replication call requires the running principal to hold DS-Replication-Get-Changes and DS-Replication-Get-Changes-All on the domain head; the check refuses to run otherwise. The custom dictionary is assembled from (Get-ADDomain).NetBIOSName, (Get-ADDomain).DNSRoot, the optional -CustomWordList file passed by the caller, plus the built-in seasons, months, and year corpus. Each base word is mangled with the SetTransform pipeline in DSInternals (Test-PasswordQuality -WeakPasswordsFile) and the resulting NT-hash candidates are compared in-memory against the replicated hash set. The finding records samAccountName, the matched dictionary entry, the mangling rule that produced the hit, the accounts userAccountControl flags, group memberships (Domain Admins, Enterprise Admins, Schema Admins, Account Operators), pwdLastSet, and lastLogonTimestamp. Plaintext passwords are never written to the report; only the dictionary base word and the rule name are recorded so the operator can confirm the pattern and the user can be re-trained.
Valor recomendado
Ninguna cuenta que use contraseñas que contengan términos específicos de la organización, patrones comunes (estación + año) o recorridos de teclado
Remediación
Cree un diccionario personalizado que incluya nombres de la empresa, nombres de productos, nombres de ubicaciones, estaciones del año y patrones comunes. Pruebe los hashes de contraseñas contra este diccionario utilizando DSInternals o herramientas similares. Fuerce cambios de contraseña en las cuentas coincidentes. Implemente filtros de contraseñas personalizados o una lista personalizada de contraseñas prohibidas de Azure AD Password Protection
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- IA-5(1)
- CIS AD Benchmark
- 5.5.4
- MITRE ATT&CK
- T1110.001, T1110.003