Tear Down The Castle - Part 2

What it is

Part two of dfir.ch's "Tear Down The Castle" series on Active Directory security, structured around "The Ten AD Commandments" and mapped to specific PingCastle findings. Its distinguishing value is empirical: the authors analyzed 250 PingCastle reports collected from Incident Response cases and Compromise Assessments, and report how many of the 250 domains were affected by each misconfiguration. This part covers commandments 6 (Privileges) and 7 (Harden critical accounts); section 8 (Print Spooler) is cut off in the fetched text.

Preconditions / Affected — prevalence in the wild

The affected-domain counts are the reason to read this. Out of 250 real-world domains:

How it works

• Dangerous privileges via GPO: e.g. a "Default Notebook Policy" granting Domain Users SeLoadDriverPrivilege, or a Default Domain Policy granting Everyone SeBackupPrivilege. Driver-load rights enable Bring Your Own Vulnerable Driver (BYOVD) — loading a signed-but-vulnerable driver (the post cites RTCore64.sys and hFiref0x's KDU repo) to reach kernel memory for local privilege escalation.
• Kerberoasting: any user can request a TGS for any account with an SPN; the ticket is encrypted with a derivative of the service password and can be brute-forced offline.
• DES: once assigned to an account, DES-encrypted tickets can be requested and cracked easily.

What to do

• Add critical accounts to the Protected Users security group. Benefits stated: CredSSP won't cache plaintext creds, Windows Digest won't cache plaintext, NTLM won't cache plaintext/NTOWF, Kerberos won't create DES/RC4 keys and won't cache plaintext or long-term keys after the initial TGT. Members also cannot use NTLM, cannot use DES/RC4 pre-auth, cannot be delegated, and cannot renew TGTs beyond the initial four-hour lifetime.
• Alternatively, set the "this account is sensitive and cannot be delegated" flag on admin accounts.
• Do not grant driver-load or backup privileges to Domain Users / Everyone via GPO; audit GPO-assigned privileges (fr0gger's Windows privileges list is referenced).

Caveats

• Protected Users requires domain functional level ≥ Windows Server 2012 R2 and "may cause operational issues, so it is worth testing in your env."
• Never add service or computer accounts to Protected Users; the group gives "incomplete protection anyway, because the password or certificate is always available on the host."
• EDR may alert on BYOVD driver loads — an alerting layer, not a guaranteed block.