Trust Direction and Transitivity: Traps and Realities

Concept

Two foundational properties dictate the operational scope of an Active Directory trust relationship:

Trust Direction:
- One-way Inbound: The local domain trusts the remote domain. Users in the remote domain can authenticate to resources in the local domain.
- One-way Outbound: The remote domain trusts the local domain. Users in the local domain can authenticate to resources in the remote domain.
- Two-way (Bidirectional): Both domains mutually trust each other. Authentication is enabled in both directions.
Transitivity:
- Transitive: If A trusts B and B trusts C, A implicitly trusts C. Authentication can traverse multiple domain hops.
- Non-transitive: Authentication is strictly restricted to the two directly connected domains. No intermediate hopping is permitted.

Why It Matters in DFIR

Multi-domain incident response frequently suffers from direction and transitivity misinterpretations:

Inverting the Attack Flow: Defenders often firewall the wrong traffic direction or falsely assume a domain is immune because it was “only” the trusting domain.
Unanticipated Multi-Hop Attack Paths: Threat actors in a partner forest can hop through transitive forest trusts to hit sensitive internal systems that engineers believed were isolated.
Memory Credential Pivoting Against the Trust Flow: If a machine in Domain A is accessed by a Domain B user across a one-way inbound trust, that Domain B user’s NTLM hash or Kerberos ticket is stored in LSASS memory on Domain A. An attacker on Domain A can harvest those credentials to pivot back into Domain B against the trust direction!

How It Works

Architectural Flow Diagram

ONE-WAY TRUST RELATIONSHIP:

    Resource Domain (CORP) ────── Trusts ─────────► Account Domain (PARTNER)
               ▲                                                │
               │                                                │
               └────────── Authentication / Attack Flow ────────┘

TRANSITIVE TRUST (Multi-Hop):

    Domain A ◄──Trust──► Domain B ◄──Trust──► Domain C
        ▲                                        │
        │                                        │
        └────── Transitive Kerberos Access ──────┘

Values of `trustDirection` Attribute in Active Directory

1: Inbound — Local domain trusts remote domain. Foreign accounts access local resources.
2: Outbound — Remote domain trusts local domain. Local accounts access foreign resources.
3: Bidirectional — Mutual trust in both directions.

What Is Possible

Accessing Resources in Any Trusting Domain: A principal in a trusted domain can present cryptographic proof to access SMB shares, SQL databases, and web applications in the trusting domain.
Executing Multi-Hop Referral Requests: An attacker can hop across child domains via the forest root without direct point-to-point trusts.
Reversing Access via Credential Harvesting: Stealing credentials of users who authenticated across a one-way trust allows an adversary to pivot in reverse.

What Is Not Possible

Accessing Trusted Domain Resources Across a One-Way Inbound Trust: If Domain A trusts Domain B, users in Domain A cannot authenticate against Domain B resources.
Transversing Non-Transitive External Trusts: An external trust between Domain A and Domain B never grants access to Domain C (parent of B).
Remotely Administering Remote Directory Objects: Trust relationships do not grant cross-domain user password reset capabilities without explicit LDAP delegation.

Common DFIR Confusions

Frequent Confusion	Verifiable Forensic Reality
”The trust is Outbound from our domain, so external threats cannot enter.”	Outbound trust means the external domain trusts your accounts. But if your accounts are compromised, they traverse outward. Inbound trust means external accounts authenticate inside!
”Non-transitive trusts prevent all lateral movement.”	They block automatic Kerberos referrals to third domains, but do not prevent harvesting credentials from memory to pivot manually.
”Forest trusts are non-transitive across child domains.”	Forest trusts are fully transitive: every domain in Forest A trusts every domain in Forest B.

Concrete Forensic Example

An engineering firm (engineering.corp) establishes a one-way trust with an external accounting consultancy (audit-firm.com):

Intended business goal: allow auditors to access a financial records portal in engineering.corp.
The TDO on engineering.corp is created with trustDirection: 1 (Inbound).
Incident: An auditor’s workstation is compromised via malware. The attacker leverages the consultant’s domain account to connect via SMB to an internal engineering file server where audit-firm.com\Domain Users was assigned write permissions.
The DFIR investigator verifies the inbound trust permitted direct ingress into corporate assets without triggering perimeter alarms.

Key Forensic Artefacts

LDAP Attributes on trustedDomain Objects:
- trustDirection: 0x1 (Inbound), 0x2 (Outbound), 0x3 (Bidirectional).
- trustAttributes: bit 0x1 (TRUST_ATTRIBUTE_NON_TRANSITIVE) denoting disabled transitivity.
Security Event Logs:
- Event ID 4624 (Target Server): Logon Type: 3, Authentication Package: Kerberos, TargetDomainName: TRUSTED_DOMAIN_NAME.
- Event ID 4769 (DC): Referral TGS requests for krbtgt/TARGET_DOMAIN_NAME.

Investigation Methods

Catalog Exact Directionality for Every Trust: Run nltest /domain_trusts /v and document [INBOUND], [OUTBOUND], or [BOTH] flags.
Audit Permissions Assigned to Foreign Security Principals: Inspect local Domain Local groups for foreign SIDs originating from trusted domains.
Analyze Cached Logon Credentials on Target Hosts: Inspect LSASS memory on servers accessed via cross-domain logons to detect foreign credentials susceptible to theft.

Investigative Tooling

Nltest:
Terminal window
```
nltest /domain_trusts /all_trusts /v
```

PowerView:

Get-DomainTrust | Select-Object TargetName, TrustDirection, TrustType, TrustAttributes

BloodHound: Graph view of TrustedBy edges: BloodHound aligns arrows with attacker lateral movement trajectories.

Key Takeaways

Trust direction is the reverse of access direction: Resource domain $ ightarrow$ trusts $ ightarrow$ Account domain.
Forest and intra-forest trusts are transitive.
External trusts are non-transitive.
One-way trusts can be traversed in reverse if credentials of incoming users are dumped from memory.