SID Filtering and Name Suffix Routing

Concept

When authentication traverses an Active Directory trust boundary, two core security mechanisms evaluate the incoming identity proof:

SID Filtering: The process by which the target domain’s KDC or LSA inspects the authentication token (Kerberos PAC or Netlogon validation payload) and strips all unauthorized, foreign, or high-privilege SIDs before delivering a service ticket or creating a security context.
Name Suffix Routing: The directory mechanism that guides KDCs on how to route client authentication requests matching specific UPN (user@subsidiary.com) or SPN (cifs/server.subsidiary.com) namespaces across forest trusts.

Why It Matters in DFIR

The configuration state of SID Filtering dictates the blast radius of an intrusion:

sIDHistory Injection Attacks: An attacker possessing the krbtgt hash of a compromised domain can inject foreign administrative SIDs (S-1-5-21-...-500 Administrator, -519 Enterprise Admins) into the PAC of a forged ticket. When SID Filtering is active, these SIDs are stripped upon arrival. If disabled, the attacker obtains instantaneous forest-level authority on the target.
Name Suffix Routing Collisions: Malicious or conflicting UPN/SPN suffixes in a trusted forest can redirect Kerberos tickets, enabling cross-forest Kerberoasting or credential interception.
Filtering Evidentiary Artifacts: Detecting events where SIDs were stripped from incoming tokens provides irrefutable forensic evidence of an active elevation attempt or legacy migration misconfiguration.

How It Works

The SID Filtering Algorithm

When an authentication ticket is presented from Domain A (Trusted) to Domain B (Trusting):

Domain B’s KDC parses all SIDs encapsulated in the PAC (User SID, Group SIDs, sIDHistory).
It evaluates them against three strict filtering tiers:
- Well-Known / High-Authority Filter: Universal high-authority SIDs (S-1-5-18 SYSTEM, S-1-5-32-544 Built-in Administrators, S-1-5-9 Enterprise DCs) originating across a trust are always stripped.
- Domain Quarantine Filter: When quarantine is enabled (/filterSIDs:Yes), only SIDs prefixed by the trusted domain’s exact domain SID are preserved. Any SID belonging to the local domain or a third-party domain is purged.
- Forest-Wide Trust Filter: Validates that incoming SIDs belong to domains explicitly recognized in the partner forest’s trusted namespace.

Incoming PAC from Remote Domain:
[ UserSID: S-1-5-21-REMOTE-1001 ] ──► ACCEPTED (Matches remote domain SID)
[ GroupSID: S-1-5-21-REMOTE-513 ]  ──► ACCEPTED (Remote Domain Users)
[ sIDHistory: S-1-5-32-544 ]      ──► PURGED & BLOCKED (Built-in Administrator)
[ sIDHistory: S-1-5-21-LOCAL-512 ] ──► PURGED & BLOCKED (Target Domain Admins)

What Is Possible

Disabling Quarantine for Migration Support: Administrators can run netdom trust /EnableSIDHistory:Yes to preserve historical access during acquisitions, but this drastically lowers security if the remote forest is compromised.
Verifying Quarantine Status via CLI: Investigators can check whether SID filtering is active by executing netdom trust <Domain> /quarantine.
Excluding Conflicting Suffixes: Administrators can disable specific routed name suffixes in Active Directory Domains and Trusts to block inbound traffic for that identity namespace.

What Is Not Possible

Passing the SYSTEM SID (S-1-5-18) Across a Trust: Even when SID filtering is relaxed, Windows LSA strictly drops universal machine-authority SIDs across inter-forest boundaries.
Bypassing SID Filtering Under Quarantine: There are no known cryptographic bypasses to keep an injected foreign SID in the PAC if the receiving KDC enforces strict domain quarantine.
Enabling SID Filtering Intra-Forest Without Operational Impact: Enabling SID filtering between parent and child domains in the same forest breaks Enterprise Admins group management and forest-wide directory services.

Common DFIR Confusions

Frequent Confusion	Verifiable Forensic Reality
”SID Filtering is enabled by default on every Active Directory trust.”	False. It is enabled by default on Forest and External trusts, but disabled by default intra-forest (Parent-Child, Tree-Root).
”Disabling quarantine allows passing any SID imaginable.”	Even with `quarantine:No`, universal Well-Known SIDs (e.g., local Administrators, SYSTEM) remain strictly filtered on forest trusts.
”Name Suffix Routing resolves IP addresses.”	No. Name Suffix Routing resolves authentication principal namespaces (UPNs, SPNs), directing clients to the appropriate foreign KDC.

Concrete Forensic Example

A manufacturing conglomerate connects an acquired supplier forest (factory.local) to corporate headquarters (corp.local) via a Forest Trust:

To simplify file migrations, administrators configured: netdom trust corp.local /domain:factory.local /enablesidhistory:yes.
A threat actor compromises a DC inside factory.local.
The attacker generates a Golden Ticket using Mimikatz and injects S-1-5-21-CORP-512 (Domain Admins of corp.local) into sIDHistory.
Because /enablesidhistory:yes was granted, the corp.local KDC accepts the injected SID without stripping it.
The attacker accesses all corp.local domain controllers with full administrative rights.
DFIR Discovery: Reviewing TDO attributes reveals disabled quarantine, explaining the catastrophic lateral movement.

Key Forensic Artefacts

LDAP Attributes on TDO (trustedDomain):
- msDS-TrustForestTrustInfo: Binary attribute holding routed name suffixes, NetBIOS names, and domain SIDs.
- trustAttributes: Bit 0x4 (QUARANTINED_DOMAIN indicating active SID filtering).
DC Security Event Logs:
- Event ID 4675 (SIDs Were Filtered): Logged when one or more SIDs are removed from an authentication token during cross-domain validation.
- Event ID 4716: Logged on the PDC Emulator when trusted domain name suffix routing is altered.

Investigation Methods

Audit SID Filtering Status for All Configured Trusts: Run netdom trust <LocalDomain> /Domain:<RemoteDomain> /quarantine to verify whether quarantine is active.
Audit SID History Allowance Across Forest Boundaries: Check if EnableSIDHistory is set to Yes on any external or forest trust.
Inspect Routed Name Suffixes: Query Get-ADTrust -Identity <RemoteForest> | Select-Object -ExpandProperty ForestTrustInfo to detect rogue or hijacked UPN suffixes.

Investigative Tooling

Netdom:

netdom trust <Domain> /Domain:<RemoteDomain> /quarantine
netdom trust <Domain> /Domain:<RemoteDomain> /namesuffixes

PowerShell AD Module:

Get-ADObject -Filter 'objectClass -eq "trustedDomain"' -Properties Name, trustAttributes, msDS-TrustForestTrustInfo |
  Select-Object Name, @{N="Quarantined";E={($_.trustAttributes -band 4) -ne 0}}

Key Takeaways

SID Filtering stops malicious privilege elevation via sIDHistory across trusts.
It is active by default on Forest and External trusts, but inactive intra-forest.
Enabling /enablesidhistory:yes across a forest trust completely eliminates the security boundary between those forests.
Event ID 4675 documents SIDs that were sanitized by the filter during token evaluation.