How Active Directory attack paths form
Active Directory is still the identity system on a lot of Windows networks. I'm not pinning a Fortune 1000 percentage on that. The old "90%" line had no source on this page, so it's gone.
An attack path is a chain of ordinary rights. A user can edit a group's membership. That group can reset a service account. That service account can delegate. None of those rights is an exploit on its own. Together they can end at a Tier 0 principal.
This page is a map of what to look for. It's not a lab, and it doesn't include ticket requests or password guessing.
What I look for
- The short chains from a normal user to Domain Admins, or to a Tier 0 server. BloodHound is the usual picture. I treat the picture as a lead, then I confirm the ACL on the object.
- ACLs that are too wide: GenericAll, WriteDacl, WriteOwner, or ForceChangePassword on a privileged user or group.
- Kerberos settings that allow offline guessing: pre-authentication turned off, or a service principal with a weak password. Detection notes are in Kerberoasting and AS-REP roasting.
- Delegation that is unconstrained, or constrained to a host a normal user can already use.
- Certificate templates that let someone request a certificate as another account. Audit notes are in AD CS misconfigurations.
How to break the path
- Tier the admin model. Domain Admins don't sign in on workstations.
- Strip the wide ACLs. A delegation should name one group and one right.
- Use a long random password, or a group managed service account, on every service principal.
- Prefer AES for Kerberos. Require pre-authentication.
- Review certificate templates on a schedule, not after an incident.
If a control is missing, write down the object and the right. Don't take the account unless the written scope says so.