ADTIER-002: Cuentas de servicio de software de copia de seguridad en grupos privilegiados
- Plataforma
- Active Directory
- Categoría
- Tier-0 Hygiene & Hybrid Identity Surface
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
El software de copia de seguridad (Veeam, Commvault, Rubrik, Cohesity, NAKIVO, Backup Exec, Vembu, Acronis) suele solicitar una cuenta de servicio con permisos muy elevados. La documentación a menudo sugiere Domain Admin para facilitar la configuración, y muchos administradores lo aceptan. Una vez que un atacante compromete el servidor de copia de seguridad (un vector frecuente de acceso inicial de ransomware), hereda Domain Admin a través de la cuenta de servicio. Esta es la ruta de escalada de ransomware número 1 en los datos de respuesta a incidentes de 2023 a 2025.
Por qué importa
Domain Admin on a backup service account means the backup server is functionally a domain controller from an attacker perspective. The blast radius is total: krbtgt hash extraction via DCSync, Golden Ticket forgery, deletion of every backup (including immutable copies that the same account can mark for early expiration through the vendor API), unrestricted lateral movement, and the ability to disable EDR and AV across the estate. Backup Operators is only nominally lower risk: the group grants SeBackupPrivilege and SeRestorePrivilege on every domain controller, which permits an attacker to back up the NTDS.dit file and SYSTEM hive offline and extract every secret in the forest. Enterprise Admins and Schema Admins extend the same outcome forest-wide and to every child domain. The combination of (a) a host that is frequently exposed, (b) a service account whose credential is cached in LSASS, the registry, or a configuration file, and (c) Tier-0 group membership is the single most exploited privilege-escalation primitive in modern ransomware playbooks (Conti, LockBit, ALPHV/BlackCat, Akira, Black Basta, and Cl0p have all leveraged it).
Ruta de ataque
1. Initial access on the backup server. Common vectors include exposed Veeam ONE / Veeam Backup Enterprise Manager web consoles, the Veeam vulnerabilities CVE-2023-27532 and CVE-2024-40711, exposed Commvault CommServe Web Console, phishing the backup admin, or pivoting from a hypervisor host the backup server has agentless access to. 2. Local privilege escalation to SYSTEM if not already there (often unnecessary because backup software runs as SYSTEM or as the privileged service account directly). 3. Credential harvesting: mimikatz sekurlsa::logonpasswords against LSASS, secretsdump.py LOCAL against the SAM and SECURITY hives, or in the case of Veeam, decryption of the encrypted credentials stored in the Veeam configuration database (Veeam-Get-Creds, veeamp.py, Veeamp). 4. The recovered credential is the backup service account, and that account is a member of Domain Admins. 5. With Domain Admin, the attacker runs DCSync against a DC, pulls the krbtgt hash, forges a Golden Ticket, and is now persistent in the forest. 6. Parallel destruction: the attacker logs into the backup console, deletes all backup jobs and repositories, expires immutable retention where the same account has the rights, and pushes the encryptor to every endpoint using the backup software push channel (a documented LockBit and Akira technique through Veeam). 7. The intrusion concludes with the ransomware payload deployed and no recoverable backups, often within 24 hours of initial access.
Cómo lo evalúa Guerrilla
Guerrilla queries Get-ADGroupMember -Recursive for each of the four protected groups and resolves nested membership through foreign security principals. For every direct or transitive member it reads sAMAccountName, distinguishedName, description, servicePrincipalName, userAccountControl, pwdLastSet, lastLogonTimestamp, and the parent OU. The account is matched against a regex set of backup-product fingerprints (veeam, commvault, simpana, rubrik, cohesity, nakivo, vembu, acronis, backupexec, bex, beadmin, networker, avamar, ppdm). Computer accounts are matched in the same way so a backup server that has been added to a protected group as a machine identity is also flagged. The check also queries the Veeam-specific SPN prefix HTTP/veeam* and the Commvault SPN prefix gxclusvc/* on member servers to identify backup hosts even when the service account name is generic. Findings include the group, the account, the matched fingerprint, the days since password rotation, and the host the account is observed logging on to (cross-correlated with ADSTALE-002 logon data when available). The check is read-only and runs against any reachable DC with standard authenticated-user rights.
Valor recomendado
Ninguna cuenta de servicio de software de copia de seguridad es miembro de Domain Admins, Enterprise Admins, Schema Admins o Backup Operators. Use cuentas de mínimo privilegio documentadas por el proveedor y credenciales de copia de seguridad aisladas.
Remediación
Identifique el producto de copia de seguridad en uso y siga su guía de mínimo privilegio (Veeam: solo administrador local del servidor de copia de seguridad + cuenta de AD con lectura de objetos; Rubrik: entidad de servicio dedicada en un rol solo de nube; etc.). Elimine la cuenta de copia de seguridad de Domain Admins. Migre a una gMSA donde esté soportado. Ubique el servidor de copia de seguridad en una OU de Tier 1 con derechos de inicio de sesión restringidos. Si un flujo de trabajo específico requiere realmente DA completo, documéntelo y aísle esa parte de la copia de seguridad en su propia cuenta, separada de la principal.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6
- CIS AD Benchmark
- 8.2.1
- MITRE ATT&CK
- T1078.002