Domain Controllers as Lateral Movement Hubs

Concept

A Domain Controller (DC) is the operational core of an Active Directory environment. It hosts ntds.dit, the Kerberos KDC, enterprise DNS, SYSVOL and NETLOGON shares, and enforces Group Policy Objects (GPOs).

When an adversary compromises a DC (via DCSync, Tier 0 credential theft, or vulnerabilities such as Zerologon or NoPac), they transform it from a directory repository into an enterprise lateral movement hub:

Universal Network Reachability: DCs have permitted firewall paths to every workstation, server, and appliance across the enterprise (SMB 445, WMI/RPC 135, WinRM 5985/5986, DNS 53).
Universal Security Authority: The DC computer account (DC$) and administrative identities possess authority to authenticate and manage all domain members.
Native Mass Distribution Mechanisms: Centralized management capabilities (GPOs, startup scripts, SYSVOL replication, multi-node WMI) allow simultaneous code execution across the fleet.

Why It Matters in DFIR

Recognizing that a DC operated as a pivot changes the investigative scope:

Triage Misdirection: Threat responders often focus on inbound DC attacks and overlook outbound propagation. A DC compromised at 02:00 UTC might be used at 04:00 UTC to execute a PowerShell deployment script pushing ransomware to 500 servers. Investigators must audit outbound DC connections.
Weaponization of SYSVOL and NETLOGON: Threat actors place malicious payloads directly in replicated shares. Because endpoints periodically pull from SYSVOL to process GPOs, payloads are downloaded under legitimate administrative processes.
Host Execution Signatures: Outbound pivot tools executed on the DC (PsExec, Invoke-TheHash, custom WMI scripts) generate distinct outbound network sockets and process command lines.

How It Works

Topology of a Weaponized Domain Controller Hub

                            ┌─────────────────────────────────┐
                            │     Domain Controller (DC)      │
                            │      (Compromised by Attacker)  │
                            └────────────────┬────────────────┘
                                             │
             ┌───────────────────────────────┼───────────────────────────────┐
             │ 1. SMB / RPC (Port 445/135)   │ 2. SYSVOL / GPO               │ 3. WinRM (Port 5985)
             ▼                               ▼                               ▼
┌─────────────────────────┐     ┌─────────────────────────┐     ┌─────────────────────────┐
│     Database Server     │     │     Fleet Endpoints     │     │      Web Jump Server    │
│ (PsExec / wmiexec)      │     │ (Malicious GPO Startup) │     │ (Invoke-Command)        │
└─────────────────────────┘     └─────────────────────────┘     └─────────────────────────┘

Direct Push via SMB/RPC: The attacker launches a script from the DC connecting across port 445 to all discovered subnet IPs using Domain Admins credentials.
Passive Pull via GPO / SYSVOL: The attacker creates or modifies a GPO linked to the domain root. Workstations fetch the updated policy during periodic background refreshes (every 90 minutes) and execute the payload.
PowerShell Remoting (WinRM): The attacker runs Invoke-Command -ComputerName (Get-ADComputer -Filter *) -ScriptBlock { ... } directly from the DC console.

What Is Possible

Fleet-Wide Deployment in Minutes: Because firewall rules permit traffic from DCs to endpoints, internal micro-segmentation rarely obstructs outbound DC connections.
Leveraging Living-off-the-Land Binaries (LOLBins): Attackers employ native binaries (psexec.exe, wmic.exe, powershell.exe) already present on the DC, blending in with legitimate systems administration.
Hijacking Concurrent Administrative Sessions: If other engineers are logged into the DC via RDP or console, an attacker can dump their LSASS tokens or inject into their sessions.

What Is Not Possible

Concealing Outbound Network Sockets: Host firewalls, active socket tables (netstat), and Sysmon/EDR telemetry capture outbound network connections to ports 445, 135, or 5985.
Targeting Powered-Down Hosts Directly: Real-time push scripts fail against offline machines, generating diagnostic network timeout errors.
Modifying SYSVOL Without DFSR Replication: Any file placed in SYSVOL automatically replicates to all other domain controllers across the forest via Distributed File System Replication.

Common DFIR Confusions

Frequent Confusion	Verifiable Forensic Reality
”Domain Controllers never initiate connections to client workstations.”	In standard operations, DCs act as servers receiving inbound traffic. Massive outbound connections from a DC to client ports 445 or 5985 represent a critical anomaly.
”Because the DC is encrypted, it was the first machine hit.”	Threat actors typically encrypt the DC last, preserving its infrastructure functionality until all endpoints have received the payload.
”Auditing the DC reveals all actions taken on target endpoints.”	The DC does not capture client-side local process executions. Validating execution requires endpoint-level triage.

Concrete Forensic Example

During a major LockBit incident response:

1,200 workstations are encrypted within a 45-minute window.
Reviewing DC01 security and Sysmon logs reveals:
- 03:12 UTC: PowerShell execution under CORP\da_admin.
- Sysmon Event 1: powershell.exe -ExecutionPolicy Bypass -File C:\ProgramData\deploy.ps1.
- The script enumerated domain computers and looped through them invoking wmic /node:<IP> process call create "C:\Windows\Temp\locker.exe".
03:58 UTC: Following the loop completion, local encryption was triggered on DC01.
DFIR Synthesis: The domain controller operated as an automated deployment server prior to its own detonation.

Key Forensic Artefacts

Domain Controller Event Logs:
- Sysmon Event ID 3 (Network Connection): Outbound connections from the DC where DestinationPort: 445 or 5985 targets internal clients.
- Sysmon Event ID 1 / Event 4688: Execution of deployment scripts, wmic.exe, psexec.exe.
- Event ID 4624 (Logon Type 2 / 10): Initial interactive or RDP session established on the DC.
Target Endpoint Security Logs:
- Event ID 4624 (Logon Type 3): Network logon where IpAddress matches the DC IP address!
- Event ID 7045: Service installation originating from the DC IP.

Investigation Methods

Audit Outbound DC Network Connections: Inspect perimeter and internal firewall logs for anomalous traffic bursts originating from the DC toward client subnets.
Inspect Shared Folders (SYSVOL / NETLOGON): Audit timestamps and hashes of .bat, .ps1, and .exe files in \\domain\SYSVOL\domain\scripts.
Hunt for Outbound LOLBin Executions: Filter DC process logs for parent processes spawning network tools targeting multiple remote hosts.

Investigative Tooling

Chainsaw / Hayabusa: Detection rules for mass lateral movement and LOLBins executed from domain controllers.

PowerShell / Get-WinEvent:

# Identify Type 3 logons received from a DC IP address
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624} |
  Where-Object { $_.Properties[7].Value -eq 3 -and $_.Properties[18].Value -eq '10.0.1.10' } | # DC IP
  Select-Object TimeCreated, @{N='User';E={$_.Properties[5].Value}}, @{N='Workstation';E={$_.Properties[11].Value}}

Key Takeaways

Domain controllers are frequently weaponized as lateral movement hubs.
Outbound connections from DCs to client SMB/WMI/WinRM ports are a critical forensic anomaly.
Attackers exploit SYSVOL and GPOs to automate code execution enterprise-wide.