Sources¶
Audit rules, sheets and attack paths rely on these references. Each rule cites its own: see Audit rules.
ANSSI¶
- Active Directory control points: the CERT-FR checklist, whose identifiers (
vuln_spn_priv,vuln_dnsadmins…) and official levels SMAD-X uses. - Recommendations for the secure administration of AD-based information systems (ANSSI-PA-099), in French: tiering.
NIST¶
- SP 800-53 Rev. 5 : security controls (least privilege AC-6, separation of duties AC-5, authenticator management IA-5…).
- SP 800-63B : authentication and password management.
CIS¶
- CIS Controls v8, control 5: account management.
- CIS Controls v8, control 6: access control management.
MITRE ATT&CK¶
| Technique | Used for |
|---|---|
| T1558.003 Kerberoasting | accounts with an SPN |
| T1558.004 AS-REP Roasting | accounts without preauthentication |
| T1558.001 Golden Ticket | krbtgt password |
| T1558 Steal or Forge Kerberos Tickets | Kerberos delegation |
| T1550.003 Pass the Ticket | delegable privileged accounts |
| T1484.001 Group Policy Modification | GPO |
| T1222.001 Windows Permissions Modification | owners and permissions |
| T1098 Account Manipulation | groups and accounts |
| T1078.002 Domain Accounts | dormant accounts, passwords not required |
Microsoft¶
- Enterprise Access Model: the tiered access model.
- Protected accounts and groups (AdminSDHolder)
- Privileged accounts and groups
- Protected Users group
- Kerberos constrained delegation
- Resetting the krbtgt password
- Least-privilege administrative models
- Group managed service accounts (gMSA)
Note
SMAD-X estimates an ANSSI-style level: it is neither ANSSI's ADS tool nor an official audit.