ADSTALE-002: Cuentas de equipo inactivas
- Plataforma
- Active Directory
- Categoría
- AD Stale & Obsolete Objects
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 0)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Las cuentas de equipo que no se han autenticado en el dominio durante un período prolongado indican sistemas dados de baja, reinstalados o sin conexión. Estas cuentas de equipo obsoletas conservan sus credenciales de máquina y pertenencias a grupos, y un atacante que recupere o restablezca la contraseña de la cuenta de máquina puede autenticarse como el equipo, con la posibilidad de acceder a recursos o realizar ataques de delegación de Kerberos
Por qué importa
A computer object in Active Directory is a security principal. It owns an NT hash derived from the machine password, it can be issued Kerberos tickets, and it can hold group memberships and ACL entries identical to a user account. When the physical system is decommissioned but the object is left enabled, three concrete risks remain. First, any cached copy of the machine credential (an old backup, a forensic image, a disposed disk, a stale SCCM secret store) becomes a valid logon credential against the domain for as long as the password is unchanged, and a stale computer account stops rotating its own password the moment the host stops booting. Second, an attacker with the ability to create or rename a computer object (the default ms-DS-MachineAccountQuota of 10 per authenticated user is sufficient) can stand up a new host with the same sAMAccountName, reset the machine password via SAMR or LDAP, and inherit the stale object's group memberships and delegation rights. Third, stale computers are routinely members of groups that grant blanket access to file shares, SQL servers, and management platforms; that access persists even after the underlying hardware is gone. Stale computer objects also distort BloodHound paths, hide unconstrained-delegation exposure that was never remediated, and inflate the apparent size of the estate in audit reports.
Ruta de ataque
1. Enumeration: from any authenticated context the attacker queries Search-ADAccount -AccountInactive -TimeSpan 90 -ComputersOnly, or runs a single LDAP filter ((&(objectClass=computer)(!userAccountControl:1.2.840.113556.1.4.803:=2)(lastLogonTimestamp<=<filetime>))). The query is readable by Authenticated Users and returns the full list of stale, enabled computers along with their group memberships. 2. Target selection: the attacker filters the result set for computers that are members of privileged groups, hold msDS-AllowedToDelegateTo entries, are TRUSTED_FOR_DELEGATION, or appear on share ACLs identified through SharpHound (CollectionMethod LocalGroup, ACL, GPOLocalGroup). 3. Credential recovery: if the attacker has access to a backup, a forensic image, or a previously dumped LSASS from the original host, the machine NT hash is extracted from the SECURITY hive ($MACHINE.ACC LSA secret) or from a cached registry export. The hash is valid for as long as the computer account password has not rotated, and a stale account never rotates. 4. Name reuse, if no cached credential is available: the attacker uses their default ms-DS-MachineAccountQuota allowance to create a new computer object, then renames or recreates one matching the stale sAMAccountName. Tools include impacket-addcomputer, StandIn, and PowerMad New-MachineAccount. Once owned, the attacker resets the password via NetUserChangePassword or Set-ADAccountPassword. 5. Authentication and lateral movement: with the machine credential in hand the attacker requests a TGT for the computer account (Rubeus asktgt /user:STALEHOST$ /rc4:<nthash>) and uses S4U2Self / S4U2Proxy where delegation rights exist, or directly accesses any resource where the computer account is on the ACL. Computer accounts on file-share ACLs, SQL logins, and management groups translate into immediate data access without touching a user account. 6. Persistence: the recovered or recreated computer account becomes a long-lived backdoor. Defenders rarely review computer-object logon activity, and a single stale account reactivated by the attacker can authenticate from anywhere with no alert.
Cómo lo evalúa Guerrilla
Guerrilla binds to a writable DC, reads the domain functional level and the configured inactivity threshold, and issues a single paged LDAP search with the filter (&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(lastLogonTimestamp<=<threshold-filetime>)). For each returned object the check pulls the supporting attributes (operatingSystem, pwdLastSet, servicePrincipalName, memberOf, msDS-AllowedToDelegateTo, msDS-AllowedToActOnBehalfOfOtherIdentity, adminCount) in the same round trip. Group membership is resolved against the domain SID so that any computer in Domain Admins, Enterprise Admins, Print Operators, Server Operators, Backup Operators, Account Operators, or a custom privileged group is surfaced as a high-severity finding rather than a routine stale-object finding. The lastLogon attribute is also collected from the bound DC and compared against lastLogonTimestamp so an analyst can detect cases where the replicated attribute is stale but the host actually logged on recently to a different DC. All queries are LDAP-only and do not require RSAT loaded on the scanning host.
Valor recomendado
Ninguna cuenta de equipo habilitada inactiva durante más de 90 días; cuentas inactivas deshabilitadas o eliminadas
Remediación
Consulte las cuentas de equipo donde lastLogonTimestamp sea anterior a 90 días usando Search-ADAccount -AccountInactive -TimeSpan 90 -ComputersOnly. Coteje con los sistemas de gestión de activos para verificar el estado de baja. Deshabilite las cuentas de equipo obsoletas y muévalas a una OU de equipos deshabilitados. Elimínelas tras un período de gracia de 60 días si el sistema no vuelve a conectarse. Elimínelas de los grupos de seguridad al deshabilitarlas
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-2(3)
- CIS AD Benchmark
- 9.1.2
- MITRE ATT&CK
- T1078.002