- Nationwide Digital Forensic & Cyber Investigation Services
Active Directory is the identity backbone of most business networks, which makes it the single highest value target once an attacker gains a foothold. Compromise of a domain controller or a privileged credential can escalate an incident from one infected workstation to control of the entire environment, and proving the true scope is one of the hardest and most consequential questions in incident response.
| Question | One line answer |
|---|---|
| What is Kerberoasting? | Requesting service ticket hashes for accounts with a service principal name and cracking them offline to recover the account password. |
| What is DCSync? | Abuse of directory replication permissions to pull password hashes for any account directly from a domain controller without touching it interactively. |
| What is a golden ticket? | A forged Kerberos ticket granting ticket built using the stolen krbtgt account hash, granting domain wide access that survives normal password resets. |
| Does resetting passwords fix a golden ticket compromise? | No, the krbtgt account itself must be reset, typically twice, and even then thorough eradication verification is required. |
| What is AD CS abuse? | Exploitation of misconfigured certificate templates to obtain a certificate that authenticates as a privileged account. |
| How is domain wide compromise proven? | By correlating domain controller logs, replication events, certificate issuance records, and endpoint telemetry across multiple hosts. |
| Term | What it means |
|---|---|
| Domain controller | A server that hosts Active Directory and processes authentication and authorization requests for the domain. |
| krbtgt account | The special service account whose password hash is used to encrypt Kerberos ticket granting tickets for the entire domain. |
| Kerberoasting | Requesting Kerberos service tickets for accounts with a service principal name, then attempting to crack the encrypted portion offline to recover a plaintext password. |
| DCSync | A technique that abuses directory replication permissions, normally reserved for domain controllers, to extract password hashes for any account directly from Active Directory. |
| Golden ticket | A forged Kerberos ticket granting ticket created using the krbtgt hash, allowing an attacker to impersonate any account in the domain for an extended period. |
| Silver ticket | A forged service ticket created using a specific service account hash, granting access to that one service without contacting a domain controller. |
| AD CS abuse | Exploitation of misconfigured Active Directory Certificate Services templates or permissions to obtain a certificate that can authenticate as a privileged account. |
Most Active Directory compromises follow a recognizable escalation pattern, and understanding it helps an examiner know which artifacts to prioritize at each stage.
An examiner tracing this chain is not only answering a historical question. The findings directly determine what has to be reset, revoked, and rebuilt before the organization can be confident the attacker no longer has access, which is why Active Directory compromise cases require close coordination between forensic findings and the remediation team throughout the engagement rather than only at the end.
No single log source tells the whole story. A defensible reconstruction correlates domain controller security events, directory service events, and certificate services logs, along with endpoint telemetry from the hosts involved at each stage.
| Evidence source | What it typically shows | Key limitation |
|---|---|---|
| Domain controller security event log | Authentication events, account changes, and, when auditing is properly configured, Kerberos ticket requests | Requires advanced audit policy to be enabled; default settings miss many relevant events |
| Directory service replication logs | Replication requests, which can reveal DCSync style extraction from a non domain controller source | Requires specific auditing to be enabled and can be missed if logging is at default levels |
| AD CS certificate services logs | Certificate requests and issuance, useful for identifying abuse of a vulnerable template | Often not enabled by default and rarely reviewed until after a compromise |
| Endpoint telemetry (EDR) | Execution of credential dumping and ticket forging tools on individual hosts | Only covers monitored endpoints and can be tampered with once an attacker has elevated privileges |
| NTDS.dit and SYSTEM hive analysis | A definitive list of every account hash present at the time of acquisition, when a domain controller is imaged | Only reflects a point in time; does not by itself show what was actually used maliciously |
Whether an investigation can even attempt to answer these questions frequently comes down to whether advanced audit policy settings, such as detailed Kerberos service ticket operations and directory service access auditing, were enabled before the incident. Organizations that have never reviewed their domain controller audit policy are often surprised to learn how little detail their logs actually captured during the compromise.
Active Directory compromise scope determinations are time sensitive and technically demanding. Our examiners can begin evidence preservation and analysis immediately.
The hardest question in an Active Directory case is often not how the attacker got in, but how far they actually reached, and whether the organization can be confident that access has truly been terminated after a golden ticket or certificate based persistence mechanism was used.
Establish the initial access point and the first account compromised, using endpoint telemetry and authentication logs.
Identify every account and host touched during lateral movement, using authentication logs, EDR telemetry, and any available network evidence.
Determine whether DCSync style replication abuse occurred, which if confirmed means every account hash in the domain must be treated as potentially compromised.
Review certificate services logs for any certificate issued to an account inconsistent with its normal role, indicating AD CS based persistence.
Confirm remediation steps taken, including a double krbtgt reset, certificate authority review, and privileged account credential rotation, and document the evidentiary basis for asserting the environment is clean.
It does not address a golden ticket built from the krbtgt hash, which requires a specific double reset of that account itself.
Any authenticated domain user can request service tickets for accounts with a service principal name, making it accessible from a low privileged foothold.
Long standing, forgotten certificate templates are a common and often overlooked path to domain compromise.
DCSync and ticket forging techniques allow domain wide compromise without ever directly logging into a domain controller interactively.
We are retained by businesses, managed service providers, and cyber insurance carriers to investigate suspected Active Directory compromise, from a single Kerberoasted service account to full domain administrator takeover. Our examiners work alongside internal IT and security teams to acquire domain controller evidence correctly, trace the true scope of compromise, and validate that remediation was complete.
Forensically sound imaging of domain controllers and export of security, directory service, and certificate services logs.
Determination of whether Kerberoasting, DCSync, or ticket forging occurred, and which accounts must be treated as compromised.
Analysis of certificate templates, permissions, and issuance logs for signs of certificate based privilege escalation.
Independent confirmation that remediation steps, including krbtgt resets and credential rotation, actually terminated attacker access.
A defensible written account of the escalation chain for counsel, carriers, and regulators.
Court qualified examiners able to explain Kerberos, replication abuse, and certificate services attacks under cross examination.
Consultations are confidential. We work directly with affected businesses, with outside counsel, and with cyber insurance carriers and brokers nationwide.
Elite Digital Forensics is an independent digital forensics firm serving businesses, attorneys, and insurers nationwide. Our examiners include former law enforcement forensic examiners who have testified as court qualified expert witnesses in state and federal proceedings. We do not sell security software and we do not manage client networks, so our findings carry no conflict of interest when the question is whether an environment was adequately secured.
Every engagement follows documented chain of custody, defensible acquisition methods, and reporting written for attorney review, insurer submission, regulator response, or courtroom use. Work performed at the direction of counsel is generally treated as attorney work product prepared in anticipation of litigation. Call (833) 292-3733 or request a confidential consultation.
Kerberoasting targets service accounts by requesting their service tickets and attempting to crack the resulting hash offline to recover a password, requiring only a standard authenticated user. DCSync abuses directory replication permissions to pull password hashes directly from a domain controller for any account, and typically requires a more privileged compromised account or misconfigured permissions to execute.
A golden ticket is forged using the krbtgt account hash rather than any individual user credential, so resetting user passwords has no effect on it. Eradicating a golden ticket requires resetting the krbtgt account password twice, since Kerberos retains the previous password for a grace period.
Detecting DCSync requires directory service access auditing to be enabled, watching for replication requests originating from a source that is not a legitimate domain controller. Without this auditing configured beforehand, DCSync activity is very difficult to detect after the fact.
It refers to exploitation of misconfigured certificate templates or permissions within an organization certificate authority, allowing a low privileged account to request a certificate that can be used to authenticate as a highly privileged account, such as a domain administrator, bypassing normal password based controls entirely.
By correlating authentication logs, endpoint telemetry, replication events, and certificate issuance records across multiple systems and accounts to trace lateral movement and privilege escalation, rather than relying on any single log source or a single compromised host as evidence of the full scope.
Not by itself. If credentials, the krbtgt account, or certificate authority integrity were compromised, rebuilding one server does not remove attacker access gained through forged tickets or abused certificates elsewhere in the domain. A full remediation plan grounded in the investigation findings is required.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder