ADTIER-002: Backup Software Service Accounts in Privileged Groups
- Plataforma
- Active Directory
- Categoría
- Tier-0 Hygiene & Hybrid Identity Surface
- Severidad
- Critical
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check enumerates the membership of the four protected groups that grant Tier-0 or near Tier-0 control: Domain Admins (S-1-5-21-<domain>-512), Enterprise Admins (S-1-5-21-<root>-519), Schema Admins (S-1-5-21-<root>-518), and Backup Operators (S-1-5-32-551). For every member it inspects the userAccountControl flags, servicePrincipalName, msDS-ManagedPasswordInterval (for gMSAs), description, and sAMAccountName for fingerprints that identify a backup-product service account. The detection set includes common naming conventions (svc-veeam, veeam-svc, backupsvc, commvault-svc, rubrik-svc, cohesity-sa, nakivo-svc, beadmin, vembu-svc, acronis-svc, backupexec, bex-svc), known SPN prefixes (veeam, commvault, rubrik), the presence of the account in the local Administrators group of a host whose computer object name matches a backup-product fingerprint, and the parent OU when it matches conventions such as OU=BackupServers or OU=ServiceAccounts/Backup. The check also reads the lastLogon and pwdLastSet attributes to flag accounts that have not rotated credentials in over 365 days, because static high-privilege credentials cached on a backup host are the worst-case combination.
Por qué importa
Domain Admin on a backup service account means the backup server is functionally a domain controller from an attacker perspective. The blast radius is total: krbtgt hash extraction via DCSync, Golden Ticket forgery, deletion of every backup (including immutable copies that the same account can mark for early expiration through the vendor API), unrestricted lateral movement, and the ability to disable EDR and AV across the estate. Backup Operators is only nominally lower risk: the group grants SeBackupPrivilege and SeRestorePrivilege on every domain controller, which permits an attacker to back up the NTDS.dit file and SYSTEM hive offline and extract every secret in the forest. Enterprise Admins and Schema Admins extend the same outcome forest-wide and to every child domain. The combination of (a) a host that is frequently exposed, (b) a service account whose credential is cached in LSASS, the registry, or a configuration file, and (c) Tier-0 group membership is the single most exploited privilege-escalation primitive in modern ransomware playbooks (Conti, LockBit, ALPHV/BlackCat, Akira, Black Basta, and Cl0p have all leveraged it).
Ruta de ataque
1. Initial access on the backup server. Common vectors include exposed Veeam ONE / Veeam Backup Enterprise Manager web consoles, the Veeam vulnerabilities CVE-2023-27532 and CVE-2024-40711, exposed Commvault CommServe Web Console, phishing the backup admin, or pivoting from a hypervisor host the backup server has agentless access to. 2. Local privilege escalation to SYSTEM if not already there (often unnecessary because backup software runs as SYSTEM or as the privileged service account directly). 3. Credential harvesting: mimikatz sekurlsa::logonpasswords against LSASS, secretsdump.py LOCAL against the SAM and SECURITY hives, or in the case of Veeam, decryption of the encrypted credentials stored in the Veeam configuration database (Veeam-Get-Creds, veeamp.py, Veeamp). 4. The recovered credential is the backup service account, and that account is a member of Domain Admins. 5. With Domain Admin, the attacker runs DCSync against a DC, pulls the krbtgt hash, forges a Golden Ticket, and is now persistent in the forest. 6. Parallel destruction: the attacker logs into the backup console, deletes all backup jobs and repositories, expires immutable retention where the same account has the rights, and pushes the encryptor to every endpoint using the backup software push channel (a documented LockBit and Akira technique through Veeam). 7. The intrusion concludes with the ransomware payload deployed and no recoverable backups, often within 24 hours of initial access.
Cómo lo evalúa Guerrilla
Guerrilla queries Get-ADGroupMember -Recursive for each of the four protected groups and resolves nested membership through foreign security principals. For every direct or transitive member it reads sAMAccountName, distinguishedName, description, servicePrincipalName, userAccountControl, pwdLastSet, lastLogonTimestamp, and the parent OU. The account is matched against a regex set of backup-product fingerprints (veeam, commvault, simpana, rubrik, cohesity, nakivo, vembu, acronis, backupexec, bex, beadmin, networker, avamar, ppdm). Computer accounts are matched in the same way so a backup server that has been added to a protected group as a machine identity is also flagged. The check also queries the Veeam-specific SPN prefix HTTP/veeam* and the Commvault SPN prefix gxclusvc/* on member servers to identify backup hosts even when the service account name is generic. Findings include the group, the account, the matched fingerprint, the days since password rotation, and the host the account is observed logging on to (cross-correlated with ADSTALE-002 logon data when available). The check is read-only and runs against any reachable DC with standard authenticated-user rights.
Valor recomendado
No backup-software service accounts are members of Domain Admins, Enterprise Admins, Schema Admins, or Backup Operators. Use vendor-documented least-privilege accounts and isolated backup credentials.
Remediación
Identify the backup product in use and follow its least-privilege guide (Veeam: backup-server local admin only + AD account with object read; Rubrik: dedicated service principal in cloud-only role; etc.). Remove the backup account from Domain Admins. Migrate to a gMSA where supported. Place the backup server in a Tier-1 OU with restricted logon rights. If full DA is genuinely required for a specific workload, document it and isolate that part of backup to its own account separate from the main one.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-6
- CIS AD Benchmark
- 8.2.1
- MITRE ATT&CK
- T1078.002