JUST RELEASED: ATT&CK for Industrial Control Systems
MITIGATIONS
Enterprise
Restrict Web-Based Content
Mobile
MITIGATIONS
Enterprise
A-C
D-F
G-I
No mitigations
J-L
M-O
P-R
S-U
V-X
Y-Z
No mitigations
Mobile
A-C
D-F
G-I
J-L
M-O
No mitigations
P-R
No mitigations
S-U
V-X
No mitigations
Y-Z
No mitigations
  1. Home
  2. Mitigations
  3. Active Directory Configuration

Active Directory Configuration

Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.

ID: M1015
Version: 1.0
Created: 06 June 2019
Last Modified: 13 June 2019

Techniques Addressed by Mitigation

Domain ID Name Description
Enterprise T1003 Credential Dumping

Manage the access control list for "Replicating Directory Changes" and other permissions associated with domain controller replication.[6][7]
Enterprise T1081 Credentials in Files

Remove vulnerable Group Policy Preferences.[1]
Enterprise T1097 Pass the Ticket

For containing the impact of a previously generated golden ticket, reset the built-in KRBTGT account password twice, which will invalidate any existing golden tickets that have been created with the KRBTGT hash and other Kerberos tickets derived from it.
Enterprise T1178 SID-History Injection

Clean up SID-History attributes after legitimate account migration is complete.

Consider applying SID Filtering to interforest trusts, such as forest trusts and external trusts, to exclude SID-History from requests to access domain resources. SID Filtering ensures that any authentication requests over a trust only contain SIDs of security principals from the trusted domain (i.e preventing the trusted domain from claiming a user has membership in groups outside of the domain).

SID Filtering of forest trusts is enabled by default, but may have been disabled in some cases to allow a child domain to transitively access forest trusts. SID Filtering of external trusts is automatically enabled on all created external trusts using Server 2003 or later domain controllers. However note that SID Filtering is not automatically applied to legacy trusts or may have been deliberately disabled to allow inter-domain access to resources.

SID Filtering can be applied by:

  • Disabling SIDHistory on forest trusts using the netdom tool (netdom trust /domain: /EnableSIDHistory:no on the domain controller)

  • Applying SID Filter Quarantining to external trusts using the netdom tool (netdom trust /domain: /quarantine:yes on the domain controller)

  • Applying SID Filtering to domain trusts within a single forest is not recommended as it is an unsupported configuration and can cause breaking changes. If a domain within a forest is untrustworthy then it should not be a member of the forest. In this situation it is necessary to first split the trusted and untrusted domains into separate forests where SID Filtering can be applied to an interforest trust[2][3][4][5]
Enterprise T1072 Third-party Software

Ensure proper system and access isolation for critical network systems through use of group policy.

References

  1. Microsoft. (2014, May 13). MS14-025: Vulnerability in Group Policy Preferences could allow elevation of privilege. Retrieved January 28, 2015.
  2. Microsoft. (2014, November 19). Security Considerations for Trusts. Retrieved November 30, 2017.
  3. Microsoft. (n.d.). Configuring SID Filter Quarantining on External Trusts. Retrieved November 30, 2017.
  4. Microsoft. (2012, September 11). Command-Line Reference - Netdom Trust. Retrieved November 30, 2017.
  1. Metcalf, S. (2015, August 7). Kerberos Golden Tickets are Now More Golden. Retrieved December 1, 2017.
  2. Metcalf, S. (2015, September 25). Mimikatz DCSync Usage, Exploitation, and Detection. Retrieved December 4, 2017.
  3. Microsoft. (n.d.). How to grant the "Replicating Directory Changes" permission for the Microsoft Metadirectory Services ADMA service account. Retrieved December 4, 2017.