ADTRUST-001: Enumeración de relaciones de confianza
- Plataforma
- Active Directory
- Categoría
- AD Trust Relationships
- Severidad
- Info
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 2
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Se deben inventariar todas las relaciones de confianza para establecer una imagen completa del límite de autenticación. Las relaciones de confianza no documentadas amplían la superficie de ataque al permitir que usuarios de dominios externos accedan a los recursos
Por qué importa
Every trust is an authentication path. A user (or attacker holding a user) on the trusted side can request a Kerberos referral ticket for a service on the trusting side, and the trusting domain controller will honor it. Without a complete inventory, defenders cannot answer the basic questions that gate every cross-forest attack: which trusts exist, in which direction, with which mitigations applied. The specific risks an inventory exposes: - Forest trusts without SID filtering (Quarantined or EnableSIDHistory off) allow SID history injection: an attacker who controls the trusted forest can mint a TGT with an Enterprise Admin SID of the trusting forest in the SIDHistory field, and the trusting forest will honor it (the Mandiant Golden SAML / SID history pattern). - Bidirectional or outbound trusts where TGT delegation is enabled (CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION 0x800) let a compromised resource in the trusted forest harvest TGTs of users from the trusting forest and replay them, the unconstrained-delegation-across-a-trust primitive published by Will Schroeder and Lee Christensen. - External trusts to long-decommissioned partner domains where the trusted DC is now attacker-controlled (or sinkholed) become a free credential path into the environment. - Shortcut trusts inside a forest reduce referral latency but multiply the number of authentication paths between domains, complicating Tier-0 segmentation. - MIT realm trusts (trustType 3) to a third-party Kerberos KDC bypass AD account policy and logging entirely. The BloodHound trust map and every cross-forest attack path tool (Rubeus, Mimikatz lsadump::trust /patch, Impacket ticketer.py) start from the trust inventory this check produces. Defenders who do not have the same inventory are operating with less situational awareness than the adversary.
Ruta de ataque
1. Reconnaissance: from any authenticated user in any domain, the attacker runs Get-ADTrust -Filter * (or nltest /domain_trusts /all_trusts, or PowerView Get-DomainTrust -SearchScope Forest). No special privilege is required: trustedDomain objects are readable by Authenticated Users. 2. BloodHound ingestion: SharpHound -CollectionMethod Trusts builds the trust graph. Edges are labeled with trust type, transitivity, and SID-filter state pulled from trustAttributes. 3. Path selection: the attacker picks a trust whose SID filtering is disabled (forest trust without Quarantined, or any external trust pre-Server 2003), or one whose TGT delegation is enabled. 4. SID history injection (no SID filtering): with krbtgt of the trusted forest, the attacker forges a TGT containing an Enterprise Admin SID of the target forest in ExtraSids. Tools: mimikatz kerberos::golden /sids:<target-EA-SID> or impacket ticketer.py -extra-sid. The trusting DC accepts the referral and grants Tier-0 access. 4a. TGT delegation abuse (CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION 0x800 set): the attacker compels a target-forest user to authenticate to a resource in the trusted forest (printer bug, PetitPotam, malicious link). The trusted resource receives the users full TGT and replays it from anywhere. 5. Forgotten-trust exploitation: a trust to a partner that no longer maintains its DC is taken over by the attacker (typosquat the DNS name, stand up a rogue DC, sign Kerberos tickets with a recovered or known-weak trust key). 6. Persistence: trust keys (the inter-realm krbtgt) are extracted with lsadump::trust /patch from any DC and can be used to forge cross-forest tickets indefinitely unless the trust is reset on both sides.
Cómo lo evalúa Guerrilla
Guerrilla enumerates trusts by binding to each domain in (Get-ADForest).Domains and calling Get-ADTrust -Filter * -Properties *. The check pulls the trustedDomain object from CN=System,<domain DN> with an LDAP filter of (objectClass=trustedDomain) and decodes the trustAttributes bitmask using the documented MS-ADTS constants. trustDirection and trustType are mapped to human-readable strings (Inbound / Outbound / Bidirectional and Forest / External / Shortcut / Realm / ParentChild / TreeRoot). For each trust the check also records whenCreated, whenChanged, the SID of the trusted domain, and whether the trust object has been modified in the last 90 days. The collector does not require elevated rights: any authenticated user can read trustedDomain objects. Results are emitted as one row per trust with all attributes resolved, which then feed the downstream ADTRUST-002 (SID filtering), ADTRUST-003 (TGT delegation), and ADTRUST-004 (selective authentication) checks.
Valor recomendado
Todas las relaciones de confianza documentadas con justificación de negocio, dirección, tipo y responsable
Remediación
Ejecute Get-ADTrust -Filter * para enumerar todas las relaciones de confianza. Documente cada relación de confianza con su dirección, tipo (bosque, externa, de acceso directo, de dominio Kerberos), transitividad y justificación de negocio. Revise y elimine cualquier relación de confianza que ya no responda a una necesidad de negocio
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-20, CA-3
- CIS AD Benchmark
- 3.1.1
- MITRE ATT&CK
- T1482