What Can an Attacker Controlling Domain A Do to Domain B?

Central Question of Multi-Domain Triage

“The attacker has full control over Domain A (Domain Admins / DCSync). What can they achieve against Domain B?”

The answer depends strictly on the boundary architecture (Intra-forest vs Inter-forest), the enforcement state of SID Filtering, and the presence of exposed sessions or delegation pathways.

Concept

When a threat actor achieves total compromise of Domain A (possessing krbtgt keys, trust passwords, and DC machine accounts), their potential actions against Domain B fall into 4 distinct architectural scenarios:

SCENARIO 1: Same Forest (Intra-Forest)
[ Domain A ] ──────────► [ Domain B ]
Outcome: TOTAL & IMMEDIATE COMPROMISE (via sIDHistory / Enterprise Admins)

SCENARIO 2: Two Forests with Forest Trust + SID Filtering ACTIVE
[ Forest A ]   ──(Filtered)──► [ Forest B ]
Outcome: NO DIRECT T0 ELEVATION. Movement is constrained by existing DACLs,
         FSP memberships, Kerberoasting, and memory session harvesting.

SCENARIO 3: Two Forests with Forest Trust + SID Filtering DISABLED (/EnableSIDHistory:Yes)
[ Forest A ]   ──(Permissive)──► [ Forest B ]
Outcome: TOTAL T0 TAKEOVER (sIDHistory accepted by target KDCs).

SCENARIO 4: External Trust (Non-transitive + SID Filtering ACTIVE)
[ Domain A ] ──(Strict Point-to-Point)──► [ Domain B ]
Outcome: STRICTLY CONFINED to Domain B resources granting explicit FSP access.

---

Why It Matters in DFIR

This analysis decisively dictates remediation boundaries:

• If A and B share the same forest: Remediation must encompass both domains concurrently. Cleaning Domain A without rotating keys across Domain B and the forest root is completely futile.
• If A and B are in separate forests with standard SID Filtering: Investigators must not assume automatic compromise of Domain B. Instead, hunt for:
  1. Accounts from Domain A nested into Domain B local groups (FSPs).
  2. Cross-forest Kerberoasting targeting Domain B SPNs.
  3. Domain B administrative accounts that logged into Domain A systems (memory credential theft).
  4. Unconstrained Kerberos delegation configured on Domain A workloads.

---

How It Works

Attack Vectors from Domain A to Domain B

1. Intra-Forest: sIDHistory Inter-Realm Golden Ticket:
   • Attacker harvests the inter-domain trust key or child domain krbtgt hash.
   • Crafts a referral TGT injecting S-1-5-21-B-512 (Domain Admins of B) or S-1-5-21-ROOT-519 (Enterprise Admins) into sIDHistory.
   • Domain B’s KDC decrypts the ticket, recognises an intra-forest trust, skips SID filtering, and issues a full-privilege service ticket.
2. Inter-Forest: Unconstrained Delegation Abuse:
   • If a compromised host in Domain A has TRUSTED_FOR_DELEGATION enabled, and a privileged user from Domain B connects to it (e.g., via SMB or RPC), that Domain B user’s full TGT is cached in LSASS on Domain A. The attacker extracts it using Mimikatz (sekurlsa::tickets) and takes over Domain B.
3. Inter-Forest: Cross-Domain Kerberoasting:
   • Any authenticated principal from Domain A can request a TGS for any registered SPN in Domain B, enabling offline password cracking against service accounts.

---

What Is Possible

• Immediate full takeover of Domain B if A and B reside in the same forest.
• Kerberoasting Domain B service accounts from Domain A across any functional trust.
• Stealing TGTs of Domain B administrators who authenticate to Domain A servers hosting Unconstrained Delegation.
• Abusing privileges assigned to Domain A Foreign Security Principals in Domain B.

---

What Is Not Possible

• Injecting Domain B administrative SIDs across an active SID Filtering boundary. Receiving KDCs strictly strip foreign SIDs.
• Remotely resetting Domain B user passwords from Domain A DCs without explicit LDAP permissions.
• Hopping beyond Domain B across an External Trust.

---

Common DFIR Confusions

Frequent Confusion	Verifiable Forensic Reality
”The trust is inter-forest, so Domain B is completely secure.”	False. If a Domain A server runs Unconstrained Delegation or if Domain A FSPs are admins on Domain B servers, Domain B can fall rapidly.
”Isolating the network cable between A and B resolves the threat.”	Network severance stops active sessions, but if Domain B credentials were already stolen on Domain A, the attacker can leverage them from external command-and-control infrastructure.
”Domain B logs will be erased if Domain A is compromised.”	Incoming logons (Event 4624 Type 3) and TGS requests (Event 4769) are preserved on Domain B DCs when the attacker crosses the boundary.

---

Concrete Forensic Example

In a healthcare network, a medical imaging domain (lab.local) is encrypted by ransomware. The main hospital domain (hospital.local) resides in a separate forest linked by a two-way Forest Trust (SID Filtering active):

1. Was SID Filtering active? Yes (Quarantine: Yes). Direct sIDHistory elevation was blocked.
2. How did the threat actor pivot to hospital.local?
   • BloodHound analysis revealed an imaging web server in lab.local configured with Unconstrained Delegation (TRUSTED_FOR_DELEGATION).
   • Event log triage on that web server showed a hospital Tier 0 administrator had initiated an SMB session to copy maintenance files 2 hours prior to encryption.
   • The attacker dumped the administrator’s TGT from LSASS and used it to compromise domain controllers across hospital.local.

---

Key Forensic Artefacts

1. Security Logs on Domain B DCs:
   • Event ID 4769: TGS requests from DOMAIN_A accounts targeting local SPNs (cross-domain Kerberoasting).
   • Event ID 4624 (Logon Type 3): Network logons showing foreign source domain in TargetDomainName.
   • Event ID 4672: Privileges assigned during foreign account logon.
2. Delegation Auditing:
   • Workstations/Servers in Domain A with userAccountControl containing TRUSTED_FOR_DELEGATION (0x80000).

---

Investigation Methods

1. Classify the Boundary Type: Determine whether A and B share a forest (Get-ADForest) or are separated by a Forest or External trust.
2. Audit Quarantine Enforcement: Run netdom trust <DomainB> /domain:<DomainA> /quarantine.
3. Identify Unconstrained Delegation Hosts in Domain A: Query for servers in Domain A capable of capturing Domain B user TGTs.
4. Inspect Cross-Domain Administrative Sessions: Analyze Event 4624 on compromised Domain A hosts for inbound connections from Domain B accounts.

---

Investigative Tooling

• PowerView / SharpHound:

  Get-DomainComputer -Unconstrained -Domain "domainA.local"
  Get-DomainForeignGroupMember -Domain "domainB.local"

• BloodHound: Query: MATCH p=shortestPath((u:User {domain:'DOMAINA.LOCAL'})-[*1..]->(d:Domain {name:'DOMAINB.LOCAL'})) RETURN p.

---

Key Takeaways

• Same Forest = Instant and total compromise of Domain B from Domain A.
• Separate Forests with SID Filtering = No direct Golden Ticket elevation.
• True cross-forest exposure stems from Unconstrained Delegation, nested FSPs, Kerberoasting, and memory credential theft.

---

References & Further Reading

• Microsoft Learn: Securing Domain and Forest Trusts
• Card 10 — Administrative Boundaries in Windows and Active Directory
• Card 16 — Cross-Domain Authentication: Kerberos Referral and NTLM Pass-Through
• Card 17 — SID Filtering and Name Suffix Routing
• Card 18 — Cross-Domain Group Membership and Foreign Security Principals