ADTIER-001: Auditoría de la cuenta de sincronización de Azure AD Connect (MSOL_)
- Plataforma
- Active Directory
- Categoría
- Tier-0 Hygiene & Hybrid Identity Surface
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Cuando Azure AD Connect se instala en modo Express, crea una cuenta de dominio llamada MSOL_<hex-aleatorio> y le concede Replicating Directory Changes y Replicating Directory Changes All sobre el contexto de nombres del dominio, es decir, derechos de DCSync. La cuenta es efectivamente de Tier 0, pero de forma predeterminada reside en el contenedor Users predeterminado, tiene una caducidad de contraseña de 10 años y rara vez aparece en las herramientas de enumeración de grupos privilegiados porque obtiene su poder mediante una ACL directa en lugar de la pertenencia a un grupo. El compromiso de esta cuenta equivale funcionalmente a una toma de control del dominio.
Por qué importa
The MSOL_ account is a domain-wide DCSync principal that is almost always overlooked during Tier-0 modelling. It is created automatically, has a non-obvious name, lives outside the protected groups, and is rotated on a long cadence (the AAD Connect tooling rotates it every 30 days for Entra Connect Sync v2 builds, but earlier versions used a 10-year expiry and never rotated unless the operator ran Add-ADSyncADDSConnectorAccount). Any of the following turns a Tier-1 compromise into a domain takeover: - Reading the MSOL_ password from the AAD Connect configuration database (encrypted with DPAPI keyed to the AAD Connect service account, recoverable from the AAD Connect host by anyone with local admin via AADInternals Get-AADIntSyncCredentials). - Coercing the AAD Connect server (which is a member server in most deployments) and relaying its machine account, then pivoting to local admin and extracting the MSOL_ credential. - Pass-the-hash or pass-the-ticket against the AAD Connect host if the operator logs on interactively with a Domain Admin account. - Reading the AD Sync connector account credential via the legacy MIIS WMI provider on older AAD Connect builds. Once the MSOL_ credential is in hand, the attacker runs DCSync against any DC, dumps the krbtgt hash, and forges Golden Tickets. The attack leaves no group-membership trail, so detections that key on Domain Admins / Enterprise Admins additions miss it entirely. The AAD Connect host is also the on-premises endpoint that writes back into Entra ID, so compromise of the host (and therefore the cloud sync account, often called Sync_<servername>_<hex> or AAD_<hex>) can be chained into Entra ID Global Administrator via Seamless SSO key theft or token forgery against the AZUREADSSOACC$ computer account.
Ruta de ataque
1. Recon: the attacker enumerates accounts matching MSOL_* via LDAP (Get-ADUser -Filter {sAMAccountName -like "MSOL_*"}) or via BloodHound (SharpHound -CollectionMethod ACL surfaces the GetChanges and GetChangesAll edges from the MSOL_ account to the domain). The AAD Connect server is identified through the SCP at CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Microsoft,CN=Services,CN=Configuration,DC=domain,DC=tld or by the presence of the ADSync service. 2. Foothold on the AAD Connect host: the attacker gains local admin on the AAD Connect server, often by coercing the server (PetitPotam / DFSCoerce) and relaying to ADCS, or by RDP from a Tier-1 jump host that was never restricted from logging on to the AAD Connect host. 3. Credential extraction: with local admin, the attacker runs AADInternals Get-AADIntSyncCredentials, which queries the ADSync SQL LocalDB instance, decrypts the encrypted blob using DPAPI keyed to the ADSync service account, and returns both the on-prem MSOL_ password and the cloud Sync_*/AAD_* credential in plaintext. Alternative paths use mimikatz lsadump::dcsync once an interactive Domain Admin logon has cached credentials on the host, or direct SQL queries against the mms_management_agent table. 4. On-prem DCSync: armed with the MSOL_ password the attacker authenticates to any domain controller and runs secretsdump.py domain/MSOL_xxxxxxxxxxxx@dc01 or mimikatz lsadump::dcsync /domain:corp.tld /user:krbtgt. The krbtgt hash is now compromised and a Golden Ticket can impersonate any principal. 5. Cloud pivot: the same extraction yields the cloud sync account, which holds the Directory Synchronization Accounts role in Entra ID. AADInternals Set-AADIntUserPassword can reset any cloud user password (including Global Administrators in tenants where the synced principals match), and Open-AADIntOffice365Portal logs in as the cloud sync identity to pivot further. 6. Persistence: the attacker may add a rogue ACE on the domain object granting Replicating Directory Changes to a second controlled principal, leave the MSOL_ password intact (so no alert fires on rotation), and configure a scheduled task on the AAD Connect host to re-extract the credential after any future rotation.
Cómo lo evalúa Guerrilla
Guerrilla queries LDAP for (|(sAMAccountName=MSOL_*)(description=*Microsoft Azure Active Directory Connect*)) with properties distinguishedName, sAMAccountName, pwdLastSet, userAccountControl, memberOf, lastLogonTimestamp, servicePrincipalName, msDS-AllowedToActOnBehalfOfOtherIdentity, and msDS-AllowedToDelegateTo. For each account returned it computes the password age in days from pwdLastSet, normalizes the parent container, and resolves the userAccountControl flags. It then binds the domain head (Get-ADObject -Identity (Get-ADDomain).DistinguishedName -Properties nTSecurityDescriptor) and walks the DACL, filtering ACEs by IdentityReference matching each MSOL_ account SID. ACEs are classified by ObjectType GUID into the expected GetChanges and GetChangesAll pair or into unexpected grants. The check also enumerates AAD Connect SCPs under CN=Microsoft,CN=Services,CN=Configuration to confirm the discovered MSOL_ accounts correspond to a registered sync endpoint and that the endpoint server object is in a Tier-0 OU. A finding is emitted if any of the following are true: the MSOL_ account is in CN=Users or a non Tier-0 OU, pwdLastSet exceeds 180 days, the account holds rights beyond the documented GetChanges / GetChangesAll pair, the account has a non-empty servicePrincipalName or a delegation attribute set, or the corresponding AAD Connect server is missing from a Tier-0 OU. Results are surfaced with the account DN, password age, ACE inventory, AAD Connect server DN, and a remediation reference.
Valor recomendado
Todas las cuentas MSOL_ inventariadas, con la contraseña rotada en los últimos 180 días, ubicadas en una OU de Tier 0 con derechos de inicio de sesión restringidos, y el propio servidor de AAD Connect endurecido como sistema de Tier 0.
Remediación
Localice la cuenta MSOL_: Get-ADUser -Filter {sAMAccountName -like 'MSOL_*'}. Confirme que tiene derechos de DCSync: dsacls 'DC=domain,DC=com' | findstr MSOL_. Muévala a una OU de administración de Tier 0. Rote la contraseña usando las herramientas de AAD Connect (NO la restablezca con las herramientas estándar, use Add-ADSyncADDSConnectorAccount en el módulo de PowerShell ADSync en el servidor de AAD Connect). Aplique una GPO de restricción de inicio de sesión para que la cuenta solo pueda iniciar sesión localmente en el propio servidor de AAD Connect. Trate el host de AAD Connect como Tier 0, restringiendo quién puede acceder a él por RDP o administrarlo.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6, IA-5
- CIS AD Benchmark
- 8.1.1
- MITRE ATT&CK
- T1003.006, T1078.004