TrustedSec Guidance: Detecting Active Directory Group Enumeration Before Privilege Escalation
TrustedSec published a defensive methodology detailing how to detect Active Directory (AD) group enumeration (MITRE ATT&CK T1069.002) as an early-warning signal preceding privilege escalation and lateral movement. The article explains that attackers commonly use tools like BloodHound/SharpHound, PowerView, and native ActiveDirectory PowerShell cmdlets to enumerate privileged group membership before escalating access, and that this reconnaissance phase is rarely monitored despite being detectable via native Windows auditing features. The post recommends combining Windows audit policies (Event 4662 and 4799) with SACLs on privileged groups, paired with honeypot/decoy groups, to generate high-confidence alerts on reconnaissance activity. TrustedSec also released an open-source PowerShell tool, QuietPhase, to assess and remediate AD audit configuration gaps.
Detalhes técnicos
Detection requires enabling Audit Directory Service Access and Audit Security Group Management policies on domain controllers, plus SACLs on groups for Everyone/Authenticated Users read access, generating Event 4662 (custom groups) or 4799 (built-in groups). The article notes blind spots: SAMR-based tools (e.g., net group /domain) bypass LDAP-based auditing entirely, and querying memberOf/tokenGroups avoids group member attribute monitoring. AdminSDHolder resets SACLs on protected groups (adminCount=1) roughly every 60 minutes, requiring the audit rule to be applied there as well. Honeypot groups (e.g., named to resemble real privileged groups) are recommended to reduce noise, since any read of a decoy group is a true positive.
Remediação
TrustedSec recommends a phased rollout: enable DC audit policies via GPO, deploy honeypot groups with SIEM alerting, baseline and filter legitimate readers for a month, then extend SACLs to Tier 0 groups (including AdminSDHolder), and validate detections using attacker tools like SharpHound/PowerView in a lab. The free tool QuietPhase (available on GitHub) automates assessment of audit policy and SACL configuration gaps and can generate remediation scripts.
Linha do tempo
-
TrustedSec Guidance: Detecting Active Directory Group Enumeration Before Privilege Escalation
ler a análise desta fonte ocultar
TrustedSec published a defensive methodology detailing how to detect Active Directory (AD) group enumeration (MITRE ATT&CK T1069.002) as an early-warning signal preceding privilege escalation and lateral movement. The article explains that attackers commonly use tools like BloodHound/SharpHound, PowerView, and native ActiveDirectory PowerShell cmdlets to enumerate privileged group membership before escalating access, and that this reconnaissance phase is rarely monitored despite being detectable via native Windows auditing features. The post recommends combining Windows audit policies (Event 4662 and 4799) with SACLs on privileged groups, paired with honeypot/decoy groups, to generate high-confidence alerts on reconnaissance activity. TrustedSec also released an open-source PowerShell tool, QuietPhase, to assess and remediate AD audit configuration gaps.
Technical Details
Detection requires enabling Audit Directory Service Access and Audit Security Group Management policies on domain controllers, plus SACLs on groups for Everyone/Authenticated Users read access, generating Event 4662 (custom groups) or 4799 (built-in groups). The article notes blind spots: SAMR-based tools (e.g.,
net group /domain) bypass LDAP-based auditing entirely, and queryingmemberOf/tokenGroupsavoids groupmemberattribute monitoring. AdminSDHolder resets SACLs on protected groups (adminCount=1) roughly every 60 minutes, requiring the audit rule to be applied there as well. Honeypot groups (e.g., named to resemble real privileged groups) are recommended to reduce noise, since any read of a decoy group is a true positive.Remediation
TrustedSec recommends a phased rollout: enable DC audit policies via GPO, deploy honeypot groups with SIEM alerting, baseline and filter legitimate readers for a month, then extend SACLs to Tier 0 groups (including AdminSDHolder), and validate detections using attacker tools like SharpHound/PowerView in a lab. The free tool QuietPhase (available on GitHub) automates assessment of audit policy and SACL configuration gaps and can generate remediation scripts.