ADTRUST-006: Selective Authentication Status
- Plataforma
- Active Directory
- Categoría
- AD Trust Relationships
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guerrilla queries CN=System,DC=<domain> for every object of class trustedDomain and reads trustAttributes, trustDirection, trustType, trustPartner, msDS-TrustForestTrustInfo, and securityIdentifier. For each entry the check decodes trustAttributes as a bitmask per MS-ADTS section 6.1.6.7.9. The TRUST_ATTRIBUTE_CROSS_ORGANIZATION bit (0x00000010) is the canonical indicator that selective authentication is active: when the bit is set, the trusting domain controllers stamp incoming TGTs from the trusted realm with the Other Organization SID and the LSA enforces an explicit Allowed-to-Authenticate ACE check on every resource access. A trust is flagged when (a) trustType is TRUST_TYPE_UPLEVEL (2) and trustAttributes includes TRUST_ATTRIBUTE_FOREST_TRANSITIVE (0x8) but does not include TRUST_ATTRIBUTE_CROSS_ORGANIZATION (0x10), or (b) trustType is TRUST_TYPE_UPLEVEL (2) and the trust is non-transitive (external) with TRUST_ATTRIBUTE_CROSS_ORGANIZATION unset. The check also captures TRUST_ATTRIBUTE_QUARANTINED_DOMAIN (0x4, SID filtering) and TRUST_ATTRIBUTE_TREAT_AS_EXTERNAL (0x40) for context, and reads the netdom trust /quarantine state via the LSA TrustedDomainEx structure so the operator sees both legs of the trust posture in one finding.
Por qué importa
A forest trust without selective authentication is functionally equivalent to merging the two forests for authentication purposes. Any compromised user, service account, or computer in the trusted forest can authenticate to any resource in the trusting forest that grants Authenticated Users, Domain Users (via well-known SID translation), or Everyone access. That set is enormous in most environments: file shares with legacy permissions, the SYSVOL share on every DC, IIS sites under Windows Authentication, SQL Server instances with mixed-mode disabled, ADCS web enrollment endpoints, RDP on member servers with the default Remote Desktop Users membership, and WSUS/SCCM consoles. Worse, the trusted forest is by definition outside the trusting forest tier zero perimeter, so a Domain Admin compromise in the trusted forest gives the attacker an Authenticated Users foothold across the trusting forest, which is the precondition for ADCS ESC1/ESC8, NTLM relay to LDAP, BloodHound enumeration, Kerberoasting of every service principal, and any number of credentialed lateral movement primitives. The Mandiant and SpecterOps red team literature consistently shows that the fastest forest-to-forest pivot is not a 0-day, it is a forest trust with selective authentication off and SID filtering quarantined. Microsoft has documented selective authentication as the recommended posture for every inter-organization trust since Windows Server 2003 R2, but it is not the default in the New Trust Wizard and is almost never retrofitted onto trusts that predate the M&A integration that demanded them.
Ruta de ataque
Step 1: Foothold in the trusted forest. The attacker compromises any account in PARTNER.LOCAL, the forest on the trusted side of the trust to CORP.LOCAL. The account does not need to be privileged in PARTNER; a help desk user, a low-tier application service account, or a stale contractor account is sufficient. Step 2: Trust enumeration. From the foothold, the attacker runs nltest /domain_trusts /v or BloodHound with the cross-forest collection method to map every trust. They identify CORP.LOCAL as a trusting forest and pull trustAttributes via an authenticated LDAP query to CORP. The absence of TRUST_ATTRIBUTE_CROSS_ORGANIZATION (0x10) confirms the trust is forest-wide. Step 3: Cross-forest authentication. Because selective authentication is off, the attacker requests a referral TGT from a PARTNER DC for a service in CORP (Kerberos cross-realm ticket via krbtgt of PARTNER signed for CORP). The CORP DC issues a service ticket whose PAC carries S-1-5-11 (Authenticated Users) and not S-1-5-1000 (Other Organization). Every CORP resource that grants Authenticated Users is now reachable. Step 4: Recon on the trusting forest. The attacker enumerates the trusting forest with the cross-forest user context: SharpHound -d corp.local --collectionmethods All, certipy find -u attacker@partner.local -dc-ip <CORP DC>, GetUserSPNs.py against every CORP user. Selective authentication being off means none of these reads are blocked at the DC. Step 5: Exploitation. The attacker finds a CORP ADCS template vulnerable to ESC1, ESC2, ESC3, or ESC8 that grants Domain Users or Authenticated Users enrollment, requests a certificate as a high-privilege CORP user via UPN/SAN supply or the relay primitive, and authenticates to CORP as Domain Admin. Alternatively the attacker locates a CORP file share with Authenticated Users:Read on a folder containing cleartext credentials, a Kerberoastable CORP service account they can crack offline, or a CORP host with unconstrained delegation that allows TGT capture. Any one of these primitives is a forest takeover. The lateral path was opened solely by the missing 0x10 bit on trustAttributes.
Cómo lo evalúa Guerrilla
Guerrilla binds to the domain naming context and runs Get-ADObject -SearchBase "CN=System,$((Get-ADDomain).DistinguishedName)" -LDAPFilter "(objectClass=trustedDomain)" -Properties trustAttributes, trustDirection, trustType, trustPartner, securityIdentifier, msDS-TrustForestTrustInfo, whenCreated. For each returned object the check decodes trustAttributes as a bitmask and emits a finding when any of the inter-organization or external trust definitions are present without the TRUST_ATTRIBUTE_CROSS_ORGANIZATION (0x10) flag. Where remote registry or WinRM is available against a DC, the check also calls Get-ADTrust -Filter * and the LSA via [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().GetAllTrustRelationships() to confirm the SelectiveAuthentication boolean exposed by the managed API matches the on-disk attribute. The check enriches each finding with the trustDirection (inbound, outbound, bidirectional), the trust age (whenCreated), the SID filtering state (TRUST_ATTRIBUTE_QUARANTINED_DOMAIN, 0x4), and the count of authentication-capable resources in the trusting forest that grant Authenticated Users (a sample of file shares, ADCS templates, and SPN-bearing accounts) so the operator can scope blast radius before remediation.
Valor recomendado
Selective authentication enabled on all forest trusts. Allowed-to-Authenticate permissions granted only on required resources
Remediación
Enable selective authentication on forest trusts via Active Directory Domains and Trusts > Properties of the trust > Authentication tab > Select 'Selective authentication'. Then grant 'Allowed to Authenticate' permission on specific computer objects that external users need to access
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-3, AC-4, AC-6
- ANSSI
- R33
- CIS AD Benchmark
- 3.2.3
- MITRE ATT&CK
- T1482, T1078.002