ADSTALE-006: Unsupported OS Versions
- Plataforma
- Active Directory
- Categoría
- AD Stale & Obsolete Objects
- Severidad
- High
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check binds to the default naming context and runs an LDAP query of the form (&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) to enumerate every enabled computer account. For each object it reads operatingSystem (string, e.g. "Windows Server 2008 R2 Standard"), operatingSystemVersion (string, e.g. "6.1 (7601)"), operatingSystemServicePack, lastLogonTimestamp, and pwdLastSet. The build identifier is normalised against the Microsoft Product Lifecycle table: Windows XP (5.1), Windows Server 2003 / 2003 R2 (5.2), Windows Vista (6.0), Windows Server 2008 / 2008 R2 (6.0 / 6.1), Windows 7 (6.1), Windows 8 / 8.1 (6.2 / 6.3), Windows Server 2012 / 2012 R2 (6.2 / 6.3), and unsupported Windows 10 feature releases (10.0 with specific build numbers such as 10240, 10586, 14393 LTSC mainstream, 15063, 16299, 17134, 17763 outside LTSC, 18362, 18363, 19041, 19042, 19043, 19044 non-LTSC). Each match is annotated with the lifecycle end-of-mainstream and end-of-extended dates, ESU eligibility, last logon recency (active within 30/90/180 days), and whether the object is a domain controller, member server, or workstation. Hosts that have not logged on within 180 days are cross-tagged so the operator can distinguish active risk from stale-account cleanup.
Por qué importa
Unsupported operating systems are a force multiplier for almost every Active Directory attack technique. They expose protocols that have been disabled by default for years on supported platforms: SMBv1 (EternalBlue, EternalRomance, MS17-010), legacy NTLM challenge-response without MIC, RC4-HMAC Kerberos enabled by policy, and TLS 1.0 / 1.1 cipher suites. They lack Credential Guard, which means LSASS plaintext credential material and Kerberos TGTs are recoverable with stock Mimikatz. They predate LSA Protection (RunAsPPL), so SeDebugPrivilege is sufficient to read the process. They are not eligible for Windows Defender ASR rules, AMSI integration in PowerShell 5.1+, or modern WDAC enforcement. Server 2008 R2 and earlier domain controllers cannot enforce LDAP signing and channel binding correctly when interoperating with newer clients, which directly enables NTLM relay paths against ADCS HTTP enrollment (PetitPotam, CVE-2021-36942) and against LDAP. Any one of these systems on a domain-joined network reintroduces removed attack surface for the entire forest, not just for itself: a compromised Server 2012 R2 file server holds the same Kerberos tickets that any 2022 server would, and an attacker who lands code execution there pivots laterally using techniques the rest of the estate has been patched against. ESU coverage mitigates publicly disclosed CVEs but does not restore the missing architectural controls.
Ruta de ataque
Step 1: Discovery. The attacker, holding any domain credential, queries Active Directory for legacy operating systems: Get-ADComputer -Filter 'OperatingSystem -like "*2008*" -or OperatingSystem -like "*2012*" -or OperatingSystem -like "*Windows 7*"' -Properties OperatingSystem, OperatingSystemVersion, LastLogonDate. The same enumeration is built into BloodHound (the OperatingSystem property is collected by SharpHound) and into adPEAS and AD security assessment tooling output. No elevated rights are required. Step 2: Reachability. The attacker scans the discovered hosts for legacy services: SMBv1 (port 445 with SMB1 negotiated), RDP without NLA, WinRM with Basic auth, RPC endpoints exposing MS-RPRN (Print Spooler) or MS-EFSR (EFSRPC / PetitPotam), and LDAP without signing. nmap --script smb-protocols and Impacket rpcdump.py enumerate the surface. Step 3: Exploitation. The attacker picks the cheapest primitive. EternalBlue (MS17-010, CVE-2017-0144) yields SYSTEM on any unpatched Server 2008 R2 or Windows 7 host that exposes SMBv1; metasploit ms17_010_eternalblue or AutoBlue is point and click. Server 2008 R2 and 2012 R2 without the May 2022 ESU patches remain vulnerable to PrintNightmare (CVE-2021-34527) for SYSTEM code execution via the Print Spooler service. Even with ESU, Server 2012 R2 lacks the post-2023 NTLM hardening and is therefore an easy NTLM relay coercion target via PetitPotam (CVE-2021-36942) into ADCS HTTP enrollment. Step 4: Credential extraction. Without Credential Guard, the attacker runs Mimikatz sekurlsa::logonpasswords against the LSASS process and recovers cleartext passwords for every interactive logon since boot, plus NTLM hashes and Kerberos TGTs for any service account that has executed locally. On a member server this typically yields a service account that is a member of a privileged group elsewhere; on a DC running Server 2008 R2 it yields the krbtgt hash directly. Step 5: Lateral movement and persistence. Recovered hashes are sprayed via pass-the-hash to modern hosts (which accept the same NTLM authentication), recovered TGTs are replayed via pass-the-ticket, and the legacy host becomes the staging point for golden-ticket forging if a DC was compromised. The unsupported OS is no longer the target; it is the launchpad.
Cómo lo evalúa Guerrilla
Guerrilla performs a paged LDAP search against the default naming context for (&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) and requests the attributes operatingSystem, operatingSystemVersion, operatingSystemServicePack, dNSHostName, lastLogonTimestamp, pwdLastSet, whenCreated, and userAccountControl. operatingSystemVersion is parsed into a (major, minor, build) tuple. The tuple is matched against an embedded lifecycle table sourced from learn.microsoft.com/lifecycle: any version whose end-of-extended-support date is earlier than the scan date is flagged. Server SKUs are differentiated from client SKUs by the operatingSystem string ("Server" substring) and by the userAccountControl SERVER_TRUST_ACCOUNT / WORKSTATION_TRUST_ACCOUNT bits. Domain controllers are identified separately by enumerating the nTDSDSA objects under CN=Sites,CN=Configuration and joining on serverReference. The check produces a per-object record with severity weighted by role (DC > member server > workstation), by recency of lastLogonTimestamp (active hosts are weighted higher than dormant), and by ESU availability for the matched OS. The output also surfaces the count of distinct legacy versions so the operator can prioritise the migration backlog.
Valor recomendado
No computers running end-of-support operating systems unless covered by Extended Security Updates with a documented migration plan
Remediación
Query computer accounts by operatingSystem attribute to identify end-of-support OS versions. Determine which systems are covered by Extended Security Updates (ESU). Create migration timelines for all unsupported systems. Implement compensating controls for systems that cannot be immediately upgraded: network segmentation, enhanced monitoring, restricted service access. Track progress against migration timelines
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- SI-2
- ANSSI
- R03
- CIS AD Benchmark
- 9.3.2
- MITRE ATT&CK
- T1210