ADSTALE-007: Foreign Security Principals huérfanos
- Plataforma
- Active Directory
- Categoría
- AD Stale & Obsolete Objects
- Severidad
- Medium
- Pilar de Zero Trust
- Governance (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Los Foreign Security Principals (FSP) son objetos de marcador de posición creados en el contenedor ForeignSecurityPrincipals cuando se agregan usuarios o grupos de dominios externos a grupos de dominio local a través de relaciones de confianza. Los FSP huérfanos hacen referencia a SID de dominios de confianza que ya no existen o a cuentas que se han eliminado, lo que da lugar a SID no resolubles en las pertenencias a grupos que saturan el control de acceso y complican la auditoría
Por qué importa
Orphaned FSPs are a low-noise indicator of three distinct problems. First, hygiene: a domain that has accumulated unresolvable SIDs in privileged groups has lost track of who actually has access, and least-privilege reviews become unreliable because the auditor cannot answer "who is this." Second, persistence cover: attackers know defenders ignore FSPs, and an attacker who controls a SID-History injection or who has compromised a remaining trusted domain can place a malicious SID into a sensitive group where it appears as a benign-looking orphan. Mimikatz sid::add and similar tooling write SID-History values that surface as FSPs in the trusting domain; if defenders treat every orphan as "just a stale trust," the malicious entry blends in. Third, lateral movement signal: an orphaned FSP whose SID prefix matches a domain that was supposedly decommissioned years ago is evidence that the trust teardown was incomplete, which often correlates with leftover trust accounts, stale krbtgt material, or unmanaged DCs in a sibling forest. None of these are remotely-exploitable on their own, but they each erode the integrity of the access model the rest of the security program depends on.
Ruta de ataque
1. Trust enumeration: the attacker enumerates trusts with nltest /trusted_domains, Get-ADTrust, or BloodHound (CollectionMethod Trusts) and identifies any trust where the trusting domain still has FSPs from the trusted side. 2. SID-History injection: with DA on a trusted forest (or via a compromised inter-forest trust where SID filtering is disabled, see ADTRUST checks), the attacker forges a TGT containing a SID-History value that points to Domain Admins of the target domain. When the ticket is presented, the KDC accepts the SID-History entry and the principal appears in the target as a foreign principal. 3. FSP planting: alternatively, with WriteMember on a local group, the attacker adds a raw SID string for a controlled (or fabricated) external principal. AD silently materializes the FSP placeholder in CN=ForeignSecurityPrincipals. Because the cn is just a SID, defenders eyeballing group membership see a generic foreign entry rather than a named account. 4. Blending: the attacker selects a SID whose domain prefix matches a long-dead trust so the entry looks like decay rather than implantation. Defenders who run no FSP audit (or who write off all FSPs as stale) never investigate. 5. Use: when the attacker re-authenticates with the corresponding ticket or as the trusted principal, the local KDC honors the group memberships granted via the FSP, including Domain Admins if it was placed there. Because the FSP is the access vector, rotating local passwords does nothing; only removing the FSP from the group breaks the path. 6. Persistence audit gap: because most AD audit tooling reports group memberships by resolved name and silently drops unresolvable SIDs, the malicious membership is invisible in standard reports. Only a tool that walks CN=ForeignSecurityPrincipals directly (this check) surfaces the entry.
Cómo lo evalúa Guerrilla
Guerrilla queries CN=ForeignSecurityPrincipals,<domainDN> with an LDAP filter of (objectClass=foreignSecurityPrincipal) and requests the attributes objectSid, cn, memberOf, whenCreated, and distinguishedName. For each returned object it constructs a System.Security.Principal.SecurityIdentifier from the binary objectSid and calls .Translate([System.Security.Principal.NTAccount]) inside a try/catch. Translation that throws IdentityNotMappedException is the orphan signal. The check also enumerates Get-ADTrust -Filter * and builds a map of trusted domain SIDs so it can label the failure mode (trust-removed vs account-deleted vs well-known-orphan such as the S-1-5-7 ANONYMOUS LOGON case). Each finding includes the FSP distinguishedName, the unresolvable SID string, the list of groups in memberOf, the inferred failure mode, and a privileged-group flag set when any entry in memberOf intersects the AdminSDHolder-protected set. The check is read-only, requires only Authenticated Users level access, and runs in seconds even on forests with thousands of FSPs because it batches the LDAP query with a paged search.
Valor recomendado
Ningún Foreign Security Principal huérfano con SID no resolubles en el dominio
Remediación
Enumere todos los objetos en CN=ForeignSecurityPrincipals e intente resolver cada SID a un nombre usando la relación de confianza correspondiente. Identifique los FSP donde el SID no pueda resolverse (relación de confianza eliminada o cuenta borrada). Elimine los FSP huérfanos de cualquier pertenencia a grupos. Elimine los objetos FSP huérfanos. Revise los FSP restantes para verificar que la relación de confianza y las cuentas referenciadas siguen siendo válidas
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-2
- CIS AD Benchmark
- 9.4.1