Windows Active Directory Güvenlik Baseline

↳ Account Policies > Password Policy > Minimum password length (varsayilan ust sinir 14) + gerekiyorsa Relax minimum password length limits = Enabled ve Minimum password length audit ile once denetim + ayricalikli gruplar icin PSO (New-ADFineGrainedPasswordPolicy)

Kisa parolalar kaba kuvvet ve parola puskurtme ile kirilir. 14 uzerine cikmak yalniz uzun parola belirlemek degil, once uyumluluk denetimi (Minimum password length audit) gerektiren bir gecistir.

↳ Account Policies > Account Lockout Policy > Account lockout threshold / Account lockout duration / Reset account lockout counter after

Otomatik kilit, online kaba kuvvet ve parola puskurtmeyi yavaslatir.

↳ Security Options > Network security: Do not store LAN Manager hash value on next password change

LM hashes are weak and can be cracked within minutes; not storing them reduces the Pass-the-Hash surface.

↳ Account Policies > Password Policy > Store passwords using reversible encryption

This setting stores passwords in a near-plaintext form; it must always be disabled.

↳ Security Options > Accounts: Rename administrator account

RID 500 hesabi kilitleme ve bircok kisitlamadan muaf oldugu icin oncelikli hedeftir. Etkili kontrol yeniden adlandirma degil, kullanim disi birakma, kasaya alma ve her kullanimini tespit etmektir.

↳ Entra Password Protection (DC agent + proxy) veya esdeger

Karmasiklik kurallari tahmin edilebilir parolalari (Sirket2026!) engellemez. Yasakli terim filtresi parola puskurtmede fiilen denenen kaliplari daha belirlenirken reddeder.

↳ Operasyonel / OU tasarimi + GPO

Tiering prevents domain admin credentials from being exposed when a workstation is compromised.

↳ AD > Groups > Domain Admins / Enterprise Admins / Schema Admins

Fewer privileged accounts reduce the attacker's target surface and the blast radius of a compromise.

↳ AD > Groups > Protected Users

This group disables NTLM, RC4, and cached credentials, narrowing the credential theft surface.

↳ GPO > Windows LAPS

A shared local admin password allows lateral movement to all machines with a single hash; LAPS breaks this.

↳ Operasyonel + GPO kisitlama

Performing administrative tasks on a hardened device without internet access prevents credential theft.

↳ Local Policies > User Rights Assignment > Deny log on ...

A privileged account logging on to a low-security device causes its credentials to be cached and stolen there.

↳ Operasyonel: resmi New-KrbtgtKeys.ps1 + repadmin /showrepl ile replikasyon dogrulamasi + Kerberos Policy deki maksimum bilet omru kadar bekleme

KRBTGT hash ele gecirilirse Golden Ticket uretilir; periyodik cift rotasyon bu bileti gecersiz kilar.

↳ AdminSDHolder container (ADUC) + SDProp

Covert persistence can be established via AdminSDHolder; adminCount artifacts outside protected groups represent a privilege leak.

↳ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

Prevents full-privilege remote sessions using a shared local admin password/hash, including RID 500; token filtering breaks lateral movement.

↳ HKLM\SYSTEM\CurrentControlSet\Control\Lsa\DsrmAdminLogonBehavior

The DSRM local administrator account on a DC can become a covert persistence and Pass-the-Hash vector.

↳ Group Policy Management > Delegation

Broad GPO permissions allow mass compromise by distributing code across the entire domain via a single policy.

↳ AD > Builtin > Backup Operators / Account Operators / Server Operators / Print Operators + DnsAdmins

Bu gruplar Domain Admins olmasa da DC de yetki yukseltir: Backup Operators SeBackupPrivilege ile NTDS.dit i kopyalar, DnsAdmins DNS servisine DLL yukleterek SYSTEM elde eder.

↳ dsa.msc > RODC bilgisayar hesabi ozellikleri > Password Replication Policy

Yalnizca ortamda RODC varsa gecerli. RODC ele gecirilirse onbellekledigi parolalar ifsa olur; ayricalikli hesaplar RODC de asla onbelleklenmemeli.

↳ Local Policies > User Rights Assignment (DC ve uye sunucu baseline GPO lari)

Bu haklar fiilen Tier 0 yetkisidir: SeDebugPrivilege LSASS bellegine, SeBackupPrivilege ise ACL leri asarak ntds.dit dahil her dosyaya erisim verir. Grup uyeligi sertlestirilse bile bu haklar dogrudan verilmisse yetki yukseltme yolu acik kalir.

↳ Windows Hello for Business / sertifika tabanli kimlik dogrulama + hesap ozellikleri (SmartcardRequired) + hibrit ortamda Conditional Access kimlik dogrulama gucu

Parola tabanli yonetici kimligi phishing, AiTM ve kimlik bilgisi hirsizligiyla calinabilir; MFA nin push/SMS bicimleri de atlatilabilir. Tier 0 icin tek gercekci savunma, kimlik dogrulamayi kaynak siteye baglayan phishing-resistant faktordur.

↳ BloodHound / dsacls / Get-Acl ile periyodik ACL denetimi + duzeltme is akisi

AD de yetki yukseltmenin buyuk kismi bir zafiyet degil, gecmiste devredilmis ve unutulmus ACL lerdir. Bu haklar hedef nesneyi dogrudan ele gecirmeye izin verir (parola sifirlama, gruba uye ekleme, sahiplik alma) ve yama ile kapanmaz.

↳ Domain NC ACL envanteri (dsacls "DC=..." veya Get-Acl) + 4662 denetimi + degisiklik alarmi

Get-Changes ve Get-Changes-All haklarinin bir arada bulunmasi DCSync ile krbtgt dahil tum parola hash lerini cekmeye yeter. AD-LOG-07 bu kullanimi tespit eder; onleyici taraf, hakka sahip principal listesinin bilinmesi ve kucuk tutulmasidir.

↳ GPO > Device Guard > Turn On Virtualization Based Security > Credential Guard: Enabled with UEFI lock

VBS ile izole edilen LSA, Mimikatz benzeri araclarin bellekten hash/ticket cekmesini engeller. DC lerde onerilmemesinin nedeni yalnizca uyumluluk degildir: Credential Guard LSASS ten turetilmis sirlari korur, DC de kimlik bilgilerinin asil kaynagi ise AD veritabaninin kendisidir (ntds.dit) ve bu korunmaz. Yani DC de ek guvenlik saglamaz, buna karsilik kimlik dogrulama bilesenleriyle uyumsuzluk riski getirir. DC koruma yolu ntds.dit/yedek erisimi ve Tier 0 izolasyonudur.

↳ HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL (+ RunAsPPLBoot) | WS2025/Win11 GPO: System > Local Security Authority > Configures LSASS to run as a protected process | Denetim: Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational (3065/3066)

PPL, korumasiz araclarin lsass.exe bellegine erismesini zorlastirir (credential dumping).

↳ HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential

If WDigest is enabled, passwords are stored in plaintext in memory; disabling it is mandatory.

↳ Security Options > Interactive logon: Number of previous logons to cache

A low number of cached credentials reduces the number of hashes that can be stolen when a DC is offline.

↳ GPO > System > Credentials Delegation > Restrict delegation of credentials to remote servers (Require Remote Credential Guard veya Restricted Admin) + istemci: mstsc /restrictedAdmin

Duz RDP oturumu kimlik bilgisini hedef sunucuda ifsa eder; ele gecirilen sunucuda yonetici kimligi calinabilir (pass-the-hash yuzeyi).

↳ GPO > System > Local Security Authority > Allow Custom SSPs and APs to be loaded into LSASS = Disabled (WS2025/Win11) + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\AllowCustomSSPsAPs

Skeleton Key ve benzeri kimlik dogrulama arka kapilari LSASS a ozel bir Security Support Provider enjekte ederek her hesap icin ikinci bir parolayi gecerli kilar; mesru kimlik dogrulamalari bozulmadigi icin fark edilmesi zordur. Ozel SSP/AP yuklenmesini engellemek teknigin ilk adimini kirar.

↳ GPO > Security Options > Network security: Configure encryption types allowed for Kerberos (AES128 + AES256 + Future) | DC: HKLM\SYSTEM\CurrentControlSet\services\KDC\DefaultDomainSupportedEncTypes = 0x18 | Hesap bazinda: msDS-SupportedEncryptionTypes | Gecis denetimi: DC System/Security logunda Kerberos 201-209 ve 4768/4769 etype alanlari

RC4 ile sifrelenen hizmet biletleri Kerberoasting ile cevrimdisi kirilir; AES bunu zorlastirir. Temmuz 2026 dan itibaren AES-only varsayilan ve geri donulemez oldugundan, AES anahtari olmayan hesaplar (parolasi hic degismemis servis hesaplari, keytab lar, eski cihazlar) kimlik dogrulayamaz. Zorlamadan once 201-209 olaylariyla envanter cikarmak ve ilgili hesaplarin parolasini sifirlamak zorunludur.

↳ Security Options > Network security: LAN Manager authentication level

NTLMv1 ve LM zayif kimlik dogrulamadir; relay ve crackinge acik.

↳ Security Options > Network security: Restrict NTLM

NTLM relay and Pass-the-Hash attacks are fundamentally based on NTLM; incremental restriction closes the attack surface.

↳ AD > Group Managed Service Accounts

gMSA uses 120+ character, automatically rotated passwords, making Kerberoasting practically ineffective.

↳ Account Policies > Kerberos Policy

Uzun bilet omru calinan veya sahte (golden/silver) biletlerin gecerlilik penceresini buyutur; saat kaymasi siniri replay yuzeyini daraltir.

↳ Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} ile denetle

An account with pre-authentication disabled has its AS-REP response crackable offline; detected on the DC via event 4768 PreAuthType=0.

↳ AD hesap ozellikleri > Delegation + Account options

A host with unconstrained delegation caches incoming TGTs; privileged tickets can be stolen to compromise the domain.

↳ Domain NC kok nesnesi (ADSI Edit) > ms-DS-MachineAccountQuota

The default value is 10; setting it to zero prevents machine account creation, a prerequisite for NoPac and RBCD attacks.

↳ setspn -L ile denetle + gMSA gecisi

The service ticket (TGS) of a privileged account carrying an SPN can be cracked offline to obtain its password.

↳ Windows Update (Agustos 2025+ CU) + OU ACL denetimi (Get-BadSuccessorOUPermissions.ps1, Akamai) + SACL denetimi (5136/5137/2946)

Windows Server 2025 te dMSA olusturabilen dusuk yetkili hesap msDS-ManagedAccountPrecededByLink ile baska bir hesabin (Domain Admin dahil) yetkisini ve Kerberos anahtarlarini devralabiliyordu. Microsoft 12 Agustos 2025 te CVE-2025-53779 yamasini yayinladi: kdcsvc.dll artik bilet verirken bagin KARSILIKLI olmasini sart kosuyor, tek yonlu link ise yaramiyor. Yama zorunludur (WS2025 DC build 26100.4946+), ancak teknik olmeksizin devam eder: OU uzerinde CreateChild ve hedef nesnede yazma yetkisi olan saldirgan karsilikli bagi kurup hedefin anahtar materyalini alabilir. Asil kalici savunma ACL sertlestirmesidir.

↳ AD bilgisayar/hesap nesnesi msDS-AllowedToActOnBehalfOfOtherIdentity + 5136 denetimi

Write access to a target msDS-AllowedToActOnBehalfOfOtherIdentity lets an attacker set up RBCD and access the resource as a privileged user via S4U (complements MachineAccountQuota=0).

↳ DC: GPO > System > KDC > KDC support for claims, compound authentication and Kerberos armoring. Istemci: System > Kerberos > Kerberos client support for claims... Zorlama secenegi: Fail unarmored authentication requests.

FAST armors pre-authentication traffic, hardening against Kerberoasting/AS-REP offline cracking and some relay scenarios.

↳ Nesne ACL denetimi (dsacls / BloodHound AddKeyCredentialLink) + Get-ADUser -Properties msDS-KeyCredentialLink envanteri + 5136 nesne degisiklik denetimi

Hedef nesneye yazma yetkisi olan saldirgan kendi urettigi anahtar ciftini msDS-KeyCredentialLink e ekler, PKINIT ile o kimlige TGT alir ve NTLM hash ini cikarir. Parola degistirmedigi icin sessizdir ve ESC14 ten (altSecurityIdentities) farkli bir tekniktir.

↳ AD hesap ozellikleri > Delegation sekmesi + Get-ADObject -Filter {msDS-AllowedToDelegateTo -like "*"} -Properties msDS-AllowedToDelegateTo envanteri

Protokol gecisi, hizmetin kullanicinin Kerberos ile kimlik dogrulamasina gerek kalmadan onun adina bilet almasina izin verir (S4U2Self). Hesap ele gecirilirse listelenen her SPN de kimlik taklidine donusur; hedef Tier 0 bir hizmetse dogrudan domain ele gecirmedir.

↳ Windows Features veya GPO ile SMB1 protokolu kaldirilir

SMBv1 is a legacy protocol vulnerable to worm-like attacks such as EternalBlue and other older exploits.

↳ Security Options > Microsoft network CLIENT: Digitally sign communications (always) = Enabled + Microsoft network SERVER: Digitally sign communications (always) = Enabled (iki ayri politika)

Zorunlu imzalama SMB relay saldirilarini engeller.

↳ GPO: Domain controller: LDAP server signing requirements = Require signing + Domain controller: LDAP server channel binding token requirements = Always. Registry: HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters (LDAPServerIntegrity=2, LdapEnforceChannelBinding=2). Once audit: 2887/2889 + 3039-3041.

Imzalama ve channel binding olmadan LDAP relay ile domain ele gecirilebilir (ADV190023).

↳ LLMNR: GPO > DNS Client > Turn off multicast name resolution = Enabled. NBT-NS: GPO Preferences Registry ile HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\{arayuz-GUID}\NetbiosOptions=2 (veya DHCP). mDNS: HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\EnableMDNS=0. Tek GPO ucunu birden kapatmaz.

Bu yayin protokolleri Responder ile zehirlenerek NTLM kimlik bilgisi calinmasina yol acar.

↳ Security Options > Network access: Do not allow anonymous enumeration of SAM accounts (RestrictAnonymousSAM=1) + Network access: Do not allow anonymous enumeration of SAM accounts and shares (RestrictAnonymous=1) (iki ayri ayar)

Anonymous enumeration gives an attacker a list of users and shares, facilitating reconnaissance.

↳ Services / GPO > Print Spooler

PrintNightmare (CVE-2021-34527) allows remote code execution and privilege escalation via the spooler.

↳ RDS yapilandirmasi + perimeter firewall

Internet-exposed RDP is the most common initial access and lateral movement vector for ransomware groups.

↳ Services (WebClient) + RPC Filter / GPO

Authentication coercion attacks (PetitPotam etc.) chain NTLM relay and ESC8 to take over the domain.

↳ DC sertifikasi + 636/TCP

Unencrypted LDAP traffic can be intercepted; LDAPS protects sensitive directory queries and credentials.

↳ w32tm yapilandirmasi (PDCe > harici NTP; uyeler > NT5DS)

Kerberos depends on a 5-minute time tolerance; uncontrolled clock skew breaks authentication and hampers log correlation and forensics.

↳ HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols + ...\Ciphers (protokol ve tekil sifre kapatma) | Computer Configuration > Administrative Templates > Network > SSL Configuration Settings > SSL Cipher Suite Order (paket siralamasi)

Eski protokol/sifreler MITM ve dusurme saldirilarina acik; LDAPS/RDP/web enrollment gibi DC servisleri guclu TLS ile korunmali.

↳ GPO > Computer Configuration > Administrative Templates > Network > Lanman Workstation > Enable insecure guest logons: Disabled

Etkinse SMB istemcisi kimlik dogrulanmamis/misafir SMB sunucularina baglanir; relay ve veri sizintisi riskini artirir.

↳ Windows Defender Firewall with Advanced Security (GPO ile merkezi kural dagitimi)

Host firewall yoksa DC-DC ve DC-istemci arasi yatay hareket kisitlanamaz; segmentasyon en az ayricalik ilkesini uygular.

↳ GPO > Domain controller: Allow vulnerable Netlogon secure channel connections (istisna listesi bos) + System log izleme: 5827/5828 (reddedilen baglanti), 5829 (izin verilen zayif baglanti - enforcement oncesi uyari), 5830/5831 (GPO istisnasiyla izin verilen)

Zerologon (CVE-2020-1472) yamasiz DC de kimlik dogrulamasiz domain ele gecirmeye izin verir. Bugun asil risk yamasizlik degil, GPO istisna listesine kalici olarak eklenmis eski cihazlardir: her istisna Zerologon yuzeyini o hesap icin yeniden acar.

↳ Security Options > Network access: Restrict clients allowed to make remote calls to SAM (kapsam: uye sunucu / istemci GPO su; DC OU suna baglanmamali)

Kisitlanmamis SAMR, saldirganin (or. BloodHound) yerel grup uyeliklerini sayarak yonetici yollarini haritalamasina izin verir. Ayni ayarin DC lere yayilmasi ise bilinen bir arizadir (bilgisayar yeniden adlandirmada 0x5 access denied): DC de bu ayarin guvenlik degeri yoktur.

↳ GPO > Computer Configuration > Administrative Templates > Network > Network Provider > Hardened UNC Paths

Sertlestirilmemis UNC yollarinda GPO dosyalari ve oturum acma betikleri araya girme (MITM) ile degistirilebilir. Tek bir zehirlenmis yanit, politika uygulayan tum makinelerde kod calistirmaya donusur; bu, GPO yu kitlesel dagitim kanalina cevirir.

↳ Win11 24H2 / WS2025 GPO: Lanman Workstation ve Lanman Server politikalari | Set-SmbClientConfiguration -RequireEncryption / -BlockNTLM | Set-SmbServerConfiguration -EnableAuthRateLimiter

Imzalama artik varsayilan zorunlu oldugu icin bir sonraki katman sifreleme ve NTLM blogudur: SMB istemcisinin NTLM e dusmesini engellemek, kimlik bilgisi hirsizligina yol acan relay ve zorlama (coercion) zincirlerinin cogunu kaynagi nda keser. Rate limiter ise SMB uzerinden parola puskurtmeyi yavaslatir.

↳ GPO > Windows Components > Windows Remote Management (WinRM) > Client ve Service (Allow Basic authentication = Disabled, Allow unencrypted traffic = Disabled) + JEA oturum yapilandirmasi (Register-PSSessionConfiguration)

Uzaktan yonetim kanali yatay hareketin ana yoludur. Basic/sifrelenmemis yapilandirma kimlik bilgisini aga acar; JEA ise ele gecirilen bir yonetim oturumunun yapabileceklerini rol yetenegiyle sinirlar ve tam yetkili kabuk vermez.

↳ DNS Manager > Zone > Properties > Dynamic updates: Secure only

With insecure updates an attacker overwrites existing A/SRV records to redirect traffic; ownership of critical records must be restricted.

↳ dnscmd /config /globalqueryblocklist wpad isatap + ADIDNS izleme

An authenticated user can add a wildcard or WPAD record in ADIDNS to poison the network and capture NTLM authentication (even with LLMNR disabled).

↳ DNS Manager > Server > Set Aging/Scavenging + periyodik denetim

Bayat kayitlar hem ad cozumleme karisikligina hem de sahipsiz (dangling) kayitlarin ele gecirilmesine yol acar. Buna karsilik yanlis hesaplanmis aralikla acilan scavenging, hala kullanimda olan kayitlari siler ve genis capli kesinti uretir; bu yuzden aralik tasarimi kontrolun parcasidir.

↳ certtmpl.msc > sablon > Subject Name + Issuance Requirements

An attacker can write a Domain Admin UPN into the SAN field, obtain a certificate for that identity, and impersonate it; this has been the most common domain takeover path via AD CS since 2022.

↳ IIS CertSrv > Authentication + Require SSL + EPA

CA web enrollment ucu NTLM relay ile DC kimligine sertifika urettirip domain ele gecirmeye yol acar (coercion ile zincirlenir).

↳ certutil -getreg policy\EditFlags (CA uzerinde)

When this flag is enabled, an arbitrary SAN can be added to any certificate request CA-wide; it extends the ESC1 impact across all templates.

↳ DC System log: Kerberos-Key-Distribution-Center Event ID 39/40/41 izleme + KB5014754 + sertifikalarin SID ile guclu eslenmesi

Zayif sertifika eslemesi Certifried (CVE-2022-26923) ile kimlik taklidine acikti; KB5014754 ayrica CVE-2022-26931 ve CVE-2022-34691 i kapatir. 11 Subat 2025 ten itibaren Full Enforcement varsayilandir.

↳ certtmpl.msc > sablon > Security

An attacker with write permission on a template can convert it to an ESC1 configuration and perform privilege escalation.

↳ CA > Properties > Auditing + tarama araci

Misconfigurations must be continuously detected and prioritized; the AD CS attack surface grows silently.

↳ certtmpl.msc > sablon > Extensions > Application Policies + Issuance Requirements

Any Purpose/SubCA EKU (ESC2) issues certificates valid for any use; Enrollment Agent EKU (ESC3) lets an attacker enroll on behalf of others to impersonate privileged identities.

↳ ADSI Edit > CN=Public Key Services,CN=Services,CN=Configuration + CA sunucu nesnesi ACL

Write access to critical PKI objects (NTAuth, CA object) lets an attacker inject a rogue CA/certificate trust and take over the domain.

↳ certsrv.msc > CA > Properties > Security

ManageCA can toggle the EDITF/SAN flag or approve a failed request to trigger the ESC1/ESC6 chain; ManageCertificates approves pending requests.

↳ certtmpl.msc > sablon msPKI-Enrollment-Flag + HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\CertificateMappingMethods

With no SID security extension and weak mapping, an attacker changes a victim userPrincipalName and logs on as a privileged account (complements strong binding AD-CS-04).

↳ certutil -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST (ardindan CertSvc yeniden baslat)

NTLM relay to the RPC (ICertPassage) endpoint mints a certificate as the victim; requiring RPC packet privacy closes the relay surface (RPC counterpart of ESC8).

↳ ADSI Edit > CN=OID,CN=Public Key Services,CN=Services,CN=Configuration > OID nesnesi msDS-OIDToGroupLink

If an OID is linked to a group, anyone holding a certificate with that issuance policy gains the group privileges - indirect privileged group membership.

↳ Windows Update KB (Kasim 2024) + certtmpl.msc > eski V1 sablonlar

On an unpatched CA an attacker injects an arbitrary application policy (Client Auth) into the CSR and obtains a privileged certificate via a V1 template.

↳ HKLM\SOFTWARE\Yubico\YubiHSM\AuthKeysetPassword erisim denetimi + CA sunucusu yerel yonetici grubu sertlestirme

CA private key HSM de saklaniyorsa HSM auth anahtari CA sunucusu registry sinde tutulur; shell erisimi olan biri anahtari okuyup CA private key ine ulasip sahte sertifika uretebilir.

↳ Get-ADUser / Get-ADComputer -Properties altSecurityIdentities ile envanter + nesne ACL de Write altSecurityIdentities yetkisini dusuk yetkiliden kaldir

altSecurityIdentities veya msDS-KeyCredentialLink yazma yetkisi olan biri kendi sertifikasini hedef hesaba eslestirip o hesap olarak kimlik dogrular.

↳ certutil -getreg policy\DisableExtensionList (CA uzerinde) - 1.3.6.1.4.1.311.25.2 listede olmamali

ESC9 un CA capindaki karsiligi; SID uzantisi CA genelinde kapatilirsa DC ler zayif UPN/SAN eslemeye doner ve ESC6/9/10 yeniden mumkun olur.

↳ CA rol yapilandirmasi + CSP/KSP veya HSM + CA sunucusu Tier 0 OU ve yerel yonetici grubu + anahtar yedegi saklama sureci

CA ozel anahtari calinirsa saldirgan istedigi kimlik icin gecerli kimlik dogrulama sertifikasi uretir (Golden Certificate). Bu kalicilik, sablon sertlestirmesinden ve DC yamalarindan bagimsizdir; yalniz CA nin yeniden anahtarlanmasi ile kapanir.

↳ AD FS sunucu rolu (Tier 0 OU + PAW ile yonetim) + Set-AdfsProperties -EnableExtranetLockout + sertifika deposu / HSM + AD FS denetim loglari

Token imzalama anahtarini ele geciren saldirgan, istedigi kullanici ve iddialarla gecerli SAML tokeni uretir (Golden SAML). Bu, MFA dahil tum federe kimlik dogrulamasini atlar, dizinde iz birakmaz ve parola sifirlamayla kapanmaz; yalniz anahtar rotasyonu ile kapanir.

↳ Entra Connect / Cloud Sync sunucusu (Tier 0 izolasyon) + senkronizasyon hesabi replikasyon izinleri denetimi (4662)

Hibrit ortamda senkronizasyon hesabi genelde DCSync esdegeri yetkiye sahiptir ve bir DC kadar kritik hedeftir; ele gecirilmesi tum on-prem AD nin ele gecirilmesi anlamina gelir.

↳ Entra Connect sunucusunda Update-AzureADSSOForest (Seamless SSO PowerShell modulu) + hesap parolasinin son degisim tarihinin izlenmesi

AZUREADSSOACC$ hesabinin parolasi hicbir zaman OTOMATIK donmez. Bu hesabin Kerberos anahtarini ele geciren saldirgan, Entra ID e karsi gecerli ve MFA yi atlayabilen kimlik dogrulama biletleri uretebilir; on-prem den bulut kimligine gecisin en sessiz yollarindan biridir.

↳ Entra Connect / Cloud Sync sunucusu (Tier 0 OU) + surum ve staging durumu + Entra rol atamalari

Entra Connect sunucusu hem on-prem dizine hem bulut kiracisina yazabilen az sayidaki varliktan biridir; ele gecirilmesi iki yonlu kimlik ele gecirmesi demektir. Desteklenmeyen surumler yamalanmaz ve staging sunucusu yoksa kurtarma suresi uzar.

↳ Dis guven: netdom trust <guven> /domain:<domain> /quarantine:Yes. Orman guveni: netdom trust <guven> /domain:<domain> /EnableSIDHistory:No. Durum dogrulama: netdom trust ... /quarantine (parametresiz sorgu)

SID filtreleme, guvenilen taraftan gelen kimliklerin yerel ormana ait ayricalikli SID leri (or. Domain Admins) SIDHistory ile enjekte etmesini engeller. Yanlis tipte komut uygulamak ya hicbir sey yapmaz ya da mesru capraz-orman erisimini keser; guven tipi once dogrulanmalidir.

↳ AD Domains and Trusts > Trust > Properties > Authentication > Selective authentication

Forest-wide authentication grants broad access across the trusted forest; selective authentication enforces least privilege and limits lateral movement.

↳ GPO / Intune > Attack Surface Reduction Rules

ASR rules block common attack behaviors (LSASS access, macro spawn) at the source.

↳ GPO > Microsoft Office > Block macros from running in Office files from the Internet

Internet-sourced macros are the primary entry point for payloads such as Emotet/QakBot.

↳ WDAC veya AppLocker politikasi

Allowlisting blocks unsigned/unknown binaries and LOLBin abuse.

↳ Intune / GPO > Windows Components > Microsoft Defender Antivirus + Microsoft Defender for Endpoint yapilandirmasi

Bu baseline in geri kalani onlemeye odaklidir; onlemeyi asan saldirganin tespiti icin DC ve Tier 0 dahil her yerde calisan, kurcalanmaya dayanikli bir EDR gerekir. Tamper protection olmadan saldirganin ilk isi korumayi kapatmak veya dislik eklemektir.

↳ Advanced Audit Policy Configuration

Without auditing, authentication, authorization, and account changes remain invisible.

↳ GPO > Windows PowerShell > Turn on PowerShell Script Block Logging

Encrypted/obfuscated PowerShell payloads are visible only through script block logging.

↳ Audit Process Creation + Include command line in process creation events: Enabled

Without command-line logging, 4688 events are weak for attack detection.

↳ Sysmon + curated config (or. SwiftOnSecurity/Olaf)

Sysmon provides process injection, image load, and network connection telemetry that built-in logs do not capture.

↳ Windows Event Forwarding / SIEM

Merkezi ve uzun sureli log, olay mudahalesi ve adli analiz icin sarttir.

↳ Windows Features > Windows PowerShell 2.0 Engine: Off

PowerShell v2 lacks logging and constrained language mode; attackers use it for downgrade attacks.

↳ Advanced Audit Policy > DS Access + replikasyon izni izleme

DCSync and Golden Ticket creation only become visible through directory access control and replication permission monitoring.

↳ SYSVOL taramasi (Get-GPPPassword / findstr cpassword)

The GPP cpassword AES key is public, so any cpassword left in SYSVOL reveals local/service account passwords.

↳ Degerlendirme araci + periyodik surec

AD misconfigurations and privilege paths accumulate over time; regular automated assessment surfaces hidden compromise chains.

↳ Security Options > Audit: Force audit policy subcategory settings... + HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SCENoApplyLegacyAuditPolicy

Bu ayar etkin degilse eski (kategori duzeyi) denetim politikasi, gelismis denetim politikasinin alt-kategori ayarlarini ezebilir ve beklenen olaylar sessizce uretilmez. AD-LOG-01 in on kosuludur: denetim acilmis gorunur ama log gelmez.

↳ GPO > Windows Components > Event Log Service > Security > Specify the maximum log file size (KB) + HKLM\SOFTWARE\Policies\Microsoft\Windows\EventLog\Security\MaxSize

Varsayilan boyutlar yogun bir DC de olay gunlugunun saatler icinde donguye girmesine yol acar. WEF/SIEM hattinda bir kesinti oldugunda geriye donuk tek kanit yerel gunluktur; kucuk gunluk, olay mudahalesinde en kritik penceresini yok eder.

↳ Advanced Audit Policy > DS Access (Directory Service Changes) + Configuration NC uzerinde SACL + 4929/5137/5141 izleme

DCShadow, gecici olarak sahte bir DC kaydeder ve replikasyon yoluyla dizine dogrudan degisiklik enjekte eder (or. SIDHistory ekleme). Degisiklik normal denetim olaylarini uretmeden geldigi icin DCSync odakli tespitlerle gorunmez; ayri bir kontrol gerekir.

↳ Windows Server Backup / yedek cozumu + plan dokumani

Reliable recovery after DCSync, a wiper, or ransomware is only possible with offline, tested backups.

↳ BitLocker Drive Encryption (GPO + TPM yapilandirmasi)

Fiziksel calinma, yanlis imha veya yetkisiz VM/snapshot kopyalama ile NTDS.dit diskten okunup tum domain hash leri disari cikarilabilir.

↳ Enable-ADOptionalFeature Recycle Bin Feature -Scope ForestOrConfigurationSet

Yanlislikla veya kotu niyetle silinen nesnelerin (kullanici/grup/OU) hizli ve guvenilir geri yuklenmesini saglar; forest recovery plani ile tamamlayici operasyonel kontroldur.

↳ Yedek deposu ve IFM medyasi ACL + hypervisor rol ayrimi (Hyper-V/vSphere yonetici rolleri) + sanal DC disk dosyalarinin erisim denetimi

DC yi ele gecirmenin en sessiz yolu isletim sistemine hic dokunmadan diskini, snapshot ini veya yedegini kopyalamaktir: ntds.dit ile SYSTEM hive birlikte tum domain parola hash lerini cevrimdisi verir. Bu yol EDR ve denetim politikalarinin tamamen disindadir ve hypervisor yoneticisini fiilen Domain Admin yapar.

↳ Security Options > Accounts: Guest account status + Builtin group uyeligi

An enabled Guest account and a broad Pre-Windows 2000 group membership open the door to unauthenticated enumeration and access.

↳ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System > EnableLUA / ConsentPromptBehaviorAdmin

Disabling UAC (EnableLUA=0) forces full-token execution and eases privilege escalation and token theft (together with token filtering in AD-PRIV-09).

↳ ADSI Edit > CN=Directory Service,... > dSHeuristics

Anonymous LDAP bind enables unauthenticated directory enumeration (users/groups/ACLs) that fuels attack preparation.

↳ WSUS / Intune / Configuration Manager + yama uyum raporlamasi

Bu baseline daki bircok kontrol ilgili yama kurulu varsayimina dayanir; yama gecikmesi sessizce diger kontrolleri gecersiz kilar.

↳ Security Options > User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin

Guvenli masaustu disinda gosterilen yukseltme istemleri baska sureclerce taklit edilebilir veya otomatik onaylanabilir. Varsayilan deger (5) Windows imzali ikililerin sessizce yukselmesine izin verdigi icin UAC atlatma tekniklerinin cogunun on kosuludur.

↳ Get-ADDomain / Get-ADForest (DomainMode, ForestMode) + Get-ADDomainController envanteri + dfsrmig /getglobalstate

Destegi biten bir DC guvenlik guncellemesi almaz ve bu baseline daki yamaya bagli kontrollerin (Zerologon, RC4 gecisi, guclu sertifika eslemesi) tamamini sessizce gecersiz kilar. Dusuk islevsellik duzeyi ise Protected Users, Authentication Silos ve gMSA gibi kontrolleri imkansiz kilar; FRS ise Windows Server 2019 ve sonrasinda desteklenmez.

↳ Search-ADAccount -AccountInactive -TimeSpan 90 + Get-ADUser -Filter {PasswordNotRequired -eq $true} + Get-ADUser -Filter {PasswordNeverExpires -eq $true} + hesap yasam dongusu sureci

Bayat hesaplar parola puskurtmenin en verimli hedefidir; kimse oturum acmadigi icin kilitlenme ve basarisiz giris de fark edilmez. Ayrica parolasi hic degismemis hesaplarda AES anahtari uretilmemis olabilir; Temmuz 2026 RC4 tam zorlamasindan sonra bu hesaplar kimlik dogrulayamaz, yani hijyen ayni zamanda bir surekliligi kontroludur.