| name | performing-active-directory-compromise-investigation |
| description | Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths. |
| domain | cybersecurity |
| subdomain | incident-response |
| tags | ["active-directory","compromise-investigation","identity-forensics","kerberos","lateral-movement","dfir","ntds-dit","golden-ticket"] |
| mitre_attack | ["T1486","T1490","T1070","T1078","T1021"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["Application Protocol Command Analysis","Network Isolation","Network Traffic Analysis","Client-server Payload Profiling","Platform Monitoring"] |
| nist_csf | ["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"] |
Performing Active Directory Compromise Investigation
Overview
Active Directory (AD) compromise investigation is a critical incident response capability that focuses on identifying how attackers gained access to domain services, what persistence mechanisms they established, and the scope of credential compromise. Since 88% of breaches involve compromised credentials (Verizon 2025 DBIR), AD is the primary target for enterprise-wide attacks. Investigators must analyze NTDS.dit database integrity, Kerberos ticket-granting activity, Group Policy modifications, replication metadata, and privileged group membership changes to reconstruct the attack chain and determine full compromise scope.
When to Use
- When conducting security assessments that involve performing active directory compromise investigation
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Familiarity with incident response concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Key Investigation Areas
1. NTDS.dit Database Analysis
The NTDS.dit file is the core Active Directory credential database containing all password hashes for domain accounts. Attackers commonly exfiltrate this file using tools like ntdsutil, secretsdump.py, or DCSync attacks via Mimikatz.
Detection indicators:
- Event ID 4662: Access to directory service objects with replication permissions
- Event ID 4742: Computer account modifications on domain controllers
- Volume Shadow Copy creation on domain controllers (Event ID 8222)
- Unusual ntdsutil.exe or vssadmin.exe execution
- Replication traffic from non-DC sources (DCSync detection)
2. Kerberos Attack Detection
Golden Ticket indicators:
- TGT tickets with abnormally long lifetimes (default is 10 hours)
- Event ID 4769 with encryption type 0x17 (RC4) instead of AES
- TGT issued without corresponding Event ID 4768 (AS-REQ)
- Kerberos tickets referencing non-existent or disabled accounts
Silver Ticket indicators:
- Service tickets without corresponding TGT requests
- Event ID 4769 with unusual service names
- Tickets with forged PAC data
Kerberoasting indicators:
