Full Report
An AD RMS Service Group account exports the AD RMS Server Licensor Certificate private key. That 1172-byte key decrypts every document the deployment ever protected, offline, and keeps doing so after the deployment is rebuilt.
Analysis Summary
# Tool/Technique: AD RMS SLC Key Extraction & SharpRMS
## Overview
Active Directory Rights Management Services (AD RMS) is a Microsoft technology designed to protect sensitive information from unauthorized access. This technique involves the extraction of the Server Licensor Certificate (SLC) private key by an account with AD RMS Service Group privileges. Because the SLC is the root of trust for the entire deployment and is issued with a 255-year validity period without a rotation mechanism, compromising this key allows for the permanent, offline decryption of every document ever protected by that deployment.
## Technical Details
- **Type:** Technique / Attack Tool
- **Platform:** Windows (Active Directory Rights Management Services)
- **Capabilities:** Root key extraction, offline document decryption, signature forging, and Rights Account Certificate (RAC) generation.
- **First Seen:** Publicized September 2024 (Research by Andrew Schwartz, Huntress).
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- **[T1555 - Credentials from Web Browsers / Secret Stores]**: Extracting keys from the RMS configuration database/SOAP surface.
- **[TA0009 - Collection]**
- **[T1560 - Archive Collected Data]**: Porting encrypted documents for offline analysis.
- **[TA0005 - Defense Evasion]**
- **[T1553.006 - Subvert Trust Controls: Code Signing]**: Forging signatures to bypass RMS client-side restrictions.
## Functionality
### Core Capabilities
- **SLC Key Extraction:** Any member of the AD RMS Service Group can export the SLC private key via a Trusted Publishing Domain (TPD) export through the service's SOAP interface.
- **Offline Decryption:** Once the 1172-byte SLC key is obtained, attackers can decrypt documents without communicating with the RMS server, bypassing all "View Only" or "No Print" restrictions.
- **Persistent Access:** Because the SLC key does not expire (255-year life) and cannot be rotated, the compromise remains effective even if the RMS server is rebuilt, provided the same key is reused.
### Advanced Features
- **SharpRMS Tool:** A unified C# binary that automates both server-side extraction and client-side attacks.
- **RAC Forging:** The tool can generate the necessary Rights Account Certificates required to simulate a legitimate user and unlock content.
- **Persistence:** Enables access to documents long since deleted from active shares but retained in backups or decommissioned hardware.
## Indicators of Compromise
- **File Names:** `slc.bin` (common name for the exported SLC key blob), `SharpRMS.exe`.
- **Network Indicators:** Unusual SOAP requests to the AD RMS pipeline URLs (e.g., `/_wmcs/certification/certification.asmx` or `/_wmcs/admin/admin.asmx`).
- **Behavioral Indicators:**
- Non-standard accounts (outside of the designated service account) joining the **AD RMS Service Group**.
- High-volume export activity involving Trusted Publishing Domains.
- Large-scale access to protected `.pfile`, `.docx`, or `.pdf` files by a single service-level account.
## Associated Threat Actors
- While no specific APT group is currently linked to this new research, the technique is highly relevant for **Insiders** or **Advanced Persistent Threats (APTs)** focused on industrial espionage and long-term data theft.
## Detection Methods
- **Behavioral Detection:** Monitor for modifications to the local "AD RMS Service Group" on the RMS server and the configuration database.
- **Log Analysis:** Enable and monitor IIS logs for the AD RMS virtual directories to identify unauthorized administrative SOAP calls.
- **Audit Logs:** Audit Event ID 4732 (A member was added to a security-enabled local group) for the RMS Service Group.
## Mitigation Strategies
- **Privileged Access Management:** Treat the AD RMS Service Group as a Tier 0 asset (equivalent to Domain Admins in impact regarding data privacy).
- **Least Privilege:** Ensure the AD RMS Service Group contains only the minimum necessary service accounts.
- **Key Protection:** Use Hardware Security Modules (HSMs) to store the SLC private key, preventing simple software-based extraction.
- **Monitoring:** Implement strict alerting for any membership changes in RMS-related AD groups.
## Related Tools/Techniques
- **DisARMS:** The original research/tooling focusing on client-side RMS bypasses.
- **DCSync:** While different in target, both techniques involve the extraction of high-value "root" cryptographic material to bypass standard authentication/authorization.