External attack paths into Tier 0 infrastructure

The gaps that produce most serious incidents are not interesting on their own. An unpatched appliance, a flat network, an EDR agent that was never installed on the file servers, a service account with more privilege than anyone remembers granting. Each of these is survivable. Organizations run for years with all four and nothing happens.

What makes an incident expensive is that they compose. No single failure has to be catastrophic. Four ordinary ones have to line up in the right order, and both the order and the destination are consistent.

The destination is Tier 0. In Microsoft’s enterprise access model, which supersedes the older Active Directory tier model, Tier 0 is the set of assets with direct or indirect control over the identity plane. The model is explicit that Tier 0 “expands to become the control plane and addresses all aspects of access control, including networking”. Most organizations still scope it to domain controllers and a handful of privileged groups. In practice it is wider, and that difference is where incidents become unrecoverable.

The way in

Initial access is usually something that was public and should not have been, or public and should have been patched: Exploit Public-Facing Application (T1190) against a service nobody was tracking. Internet-facing gateways and VPN appliances recur because they are exposed by design, terminate credentials, and sit where the network is weakest.

The failure is rarely that nobody patches. It is that nobody has a complete list of what is exposed. Hosts get stood up for a project and never torn down, a subsidiary arrives through an acquisition with infrastructure nobody has mapped, a developer publishes a staging environment with production data and a default password.

Your external attack surface is not what your inventory says. It is what resolves. Those two lists diverge continuously, and only one of them is being scanned by other people.

Nothing slows lateral movement

Most firewall rulesets are configured almost entirely for north-south traffic. Rules facing the internet are reviewed, argued over, and documented. Internal traffic moves without inspection, because writing east-west policy is tedious and nothing visibly breaks when you skip it.

Two conditions do most of the damage:

• Management planes reachable from user subnets. Out-of-band controllers, hypervisor management, switch and firewall administration, storage controllers. A workstation should not be able to open a session to any of these, and frequently it can.
• Unrestricted egress. Command and control leaves over 443 to a host with a valid certificate and a clean reputation. If everything outbound is permitted, there is nothing to notice.

Segmentation only matters at the moment it fails, which is also the only moment anyone finds out whether it works.

Nothing is watching

Detection fails in two distinct ways, and they need different fixes.

The first is coverage. EDR gets deployed thoroughly to workstations, less thoroughly to servers, and not at all to the things that cannot run an agent: hypervisors, network appliances, storage, printers, and most operational technology. Those gaps are precisely where an attacker who has read a deployment guide will choose to operate.

The second is that logs arrive and nothing happens. A SIEM ingesting everything with no detection content for the techniques that actually apply is an expensive archive. So is one with retention too short to reconstruct an intrusion that began months before it was noticed.

The useful question is not whether you have EDR and a SIEM. It is: if this specific action happened at 03:00 on a Sunday, what fires, who receives it, and what do they do next? That is answerable, and answering it honestly is usually uncomfortable.

Identity is the route into Tier 0

Nobody designs a path from a helpdesk account to Domain Admin. It accumulates. Ten years of migrations, temporary fixes made permanent, an application vendor who insisted on excessive rights, a group nested inside a group nested inside a group that somebody added to a privileged role in 2019.

The recurring findings are not exotic, and they all have names:

• Kerberoasting (T1558.003). A service account with a service principal name, high privilege, and a weak password is offline-crackable by any authenticated user in the domain. No special access is needed to request the ticket.
• Unconstrained or over-broad delegation, which lets a compromised host impersonate any account that authenticates to it.
• Local administrator password reuse across a fleet, which turns one workstation into all of them. LAPS, or Windows LAPS on current builds, closes this and costs nothing.
• Accounts in privileged groups belonging to people who left, and access control entries granting rights nobody intended to grant. Both are usually invisible until someone draws the graph.

The end state is DCSync (T1003.006), where sufficient directory rights allow replication of password hashes for any account, including krbtgt. At that point the domain is not compromised in a way that gets cleaned up. It gets rebuilt.

None of this is hard to find. BloodHound, or any tool that builds the same graph, surfaces the paths in hours, and most of them close with a configuration change rather than a project.

The hybrid seam

Hybrid identity deserves separate attention, because it is the clearest case of Tier 0 extending past where anyone drew the boundary.

The directory synchronization account, and the service that runs it, hold rights over both directories at once. Depending on which optional features are enabled, that service can write to on-premises Active Directory, reset cloud passwords, or both. It is frequently installed on an ordinary member server, administered by whoever set it up, and excluded from the privileged access model on the grounds that it is “just sync”.

The same applies to federation infrastructure. A server that signs authentication tokens for the tenant can mint a token for any user in it, which makes it Tier 0 by any reading of the definition, cloud or on-premises. Treat both as domain controllers, because in terms of what their compromise grants, they are.

What actually belongs to Tier 0

This is the part that decides whether an incident is a bad month or an existential event, and it gets the least attention.

Three systems qualify as Tier 0 on the definition above, whether or not anyone has classified them that way:

• A hypervisor hosting domain controllers has full access to their memory and disk. Host-level access defeats every control running inside the guest.
• A backup system holding domain controller system state can be used to extract or reconstitute the domain offline. Possession of the backup is possession of the directory.
• Edge firewalls and network management determine which paths exist at all, including the ones you would use to contain an intrusion.

This is not a novel reading of the model. Microsoft’s own guidance on securing domain controllers advises running virtual domain controllers on physical hosts separate from the rest of the estate, and describes shielded VMs as protection against “malicious or uninformed fabric administrators (including virtualization, network, storage and backup administrators)”. Those four roles are exactly the ones usually left outside the Tier 0 boundary.

System	What its compromise means	Quickest check
Virtualization management	Host-level access defeats every control running inside the guest	Who can log in, and from where
Backup infrastructure	Recovery ceases to be available, which is what makes extortion effective	Are backups reachable with a domain account
Edge and network management	Containment ceases to be available, and the attacker governs the network paths	Is administration on the same identity domain

The common thread is the third column. All three are usually administered with accounts from the same directory as everything else, which means they are not a second obstacle after Active Directory. They are the same obstacle. Once the directory falls, all three fall with it, simultaneously, which is exactly when you need them.

The control that addresses this is not sophisticated. Separate the administration of Tier 0 assets from ordinary domain identity: distinct accounts that never authenticate to lower tiers, dedicated administrative workstations, and no path from a user desktop to a management interface. It is well documented and largely free. It is also, routinely, either absent or written down and never enforced.

Backups deserve one further point. Destroying them is a documented objective in its own right, Inhibit System Recovery (T1490), which now explicitly covers deleting cloud snapshots and disabling backup policies rather than only clearing volume shadow copies. A backup job reporting success is not the same as a recovery that completes. Ask whether yours are reachable over SMB with a domain account, whether immutability or an air gap is enabled rather than merely licensed, and when anyone last restored at the scale a real incident would demand. An incident is the costliest point at which to establish the answer.

Where to start

If you do nothing else, these five are quick and disproportionately useful:

1. Enumerate what actually resolves on your external addresses, then compare it with your asset inventory. Work through the difference.
2. From a standard user workstation, try to reach the management interface of a hypervisor, a firewall, or a backup server. Fix whatever succeeds.
3. Run graph analysis against Active Directory and close the shortest three paths to a privileged role.
4. Write down what you consider Tier 0. If virtualization, backup, and network management are not on the list, that is the finding.
5. Restore something substantial from backup, on a normal working day, and time it.

None of this is novel, and that is the point. The path repeats because each step is cheap to leave in place and only becomes expensive at the moment they are used together. The question worth asking is not whether your organization has these gaps. It is which step you could remove this quarter.

References

• Microsoft, Securing privileged access: enterprise access model. Defines the control plane and the Tier 0 scope expansion.
• Microsoft, Securing domain controllers against attack. Covers virtual domain controller placement, fabric administrator risk, and forest recovery.