Active Directory Investigation Decision Tree

Concept

The Active Directory Investigation Decision Tree structures investigative reasoning, transforming raw, high-volume event logs into actionable forensic conclusions.

It pivots across 4 decisive architectural bifurcations:

Branch 1: Authenticating Authority (Local SAM vs Active Directory Domain).
Branch 2: Negotiated Protocol (Kerberos vs NTLM).
Branch 3: Cryptographic Token Validity (Legitimate KDC vs Synthetic Forgery).
Branch 4: Effective Host Action (Telemetry Discovery vs Lateral Movement vs Host Compromise).

How It Works: The Comprehensive Decision Flowchart

Suspicious Authentication Alert: Event 4624 (Successful Logon) on a Server
│
├── [Q1] Does TargetDomainName match the local machine hostname?
│    │
│    ├── YES ──► LOCAL SAM AUTHENTICATION
│    │           │
│    │           ├── [Q1.1] Is the password reused across other fleet endpoints?
│    │           │    ├── YES ──► HIGH RISK: Cascading local Pass-the-Hash (Absence of LAPS).
│    │           │    └── NO  ──► Incident strictly isolated to this host.
│    │
│    └── NO  ──► ACTIVE DIRECTORY DOMAIN AUTHENTICATION
│                │
│                ├── [Q2] What protocol is recorded in LogonProcessName?
│                │    │
│                │    ├── NtLmSsp (NTLM)
│                │    │    │
│                │    │    ├── [Q2.1] Is source IP internal and does Event 4776 exist on the DC?
│                │    │    │    ├── YES ──► Pass-the-Hash or NetExec via IP. Hunt source endpoint.
│                │    │    │    └── NO  ──► NTLM Relay or authentication coercion (PetitPotam).
│                │    │
│                │    └── Kerberos
│                │         │
│                │         ├── [Q3] Do matching Event 4768 (TGT) and 4769 (TGS) exist on DCs?
│                │         │    │
│                │         │    ├── YES ──► STANDARD KERBEROS TRANSACTION
│                │         │    │           Audit TicketEncryptionType (0x17 = RC4 anomaly).
│                │         │    │
│                │         │    ├── 4769 present WITHOUT preceding 4768 ──► GOLDEN TICKET DETECTED!
│                │         │    │   (Tier 0 krbtgt compromise -> Consecutive double reset required).
│                │         │    │
│                │         │    └── ZERO 4768 or 4769 records on DCs ──► SILVER TICKET DETECTED!
│                │         │        (Target machine or service account key compromised).
│                │
│                └── [Q4] Was the logon followed by malicious execution?
│                     │
│                     ├── Event 5140 (ADMIN$ / C$) WITHOUT Event 7045 or 4688
│                     │    └── NetExec (Pwn3d!) reconnaissance without payload execution.
│                     │
│                     ├── Event 7045 (New Service) or Event 4688 under SYSTEM
│                     │    └── Active lateral movement (PsExec, smbexec, WMI). Host compromised!
│                     │
│                     └── Event 4662 on DC with replication Extended Right GUID
│                          └── DCSync Attack! Directory NTDS database extracted.

Step-by-Step Implementation Guide

Step 1: Characterize Identity Scope

Query Event ID 4624 on target host:
- Record TargetDomainName, TargetUserName, TargetUserSid, LogonType, LogonProcessName, IpAddress.
Compare TargetDomainName with local machine hostname:
- If identical $\rightarrow$ Follow the Local SAM branch.
- If different $\rightarrow$ Follow the Active Directory Domain branch.

Step 2: Validate the Issuing Authority

If NTLM:
- Query primary DC for Event ID 4776 filtered by TargetUserName.
- If present: credentials were verified by AD; check Event 8004 for Netlogon routing.
If Kerberos:
- Search forest KDCs for Event ID 4769 matching the user and service within the preceding 10 hours.
- If present with ServiceName: krbtgt $\rightarrow$ Legitimate cross-domain referral.
- If completely absent on DCs $\rightarrow$ Confirm Silver Ticket forgery.

Step 3: Evaluate Host Impact

Filter events occurring within 120 seconds post-logon:
- Event ID 5140 / 5145: Shared files and folders accessed.
- Event ID 7045: Services installed.
- Event ID 4688 / Sysmon 1: Child processes spawned (cmd.exe, powershell.exe).

Actionable Incident Classification Matrix

Decision Tree Outcome	Severity	Immediate Containment Action
Local Pass-the-Hash (SAM)	High (Host)	Network-isolate host, rotate local administrator password, audit LAPS.
NetExec `(Pwn3d!)` without Execution	Medium	Reset compromised account password, trace source IP.
Active Lateral Movement (Event 7045)	Critical	Isolate endpoint, acquire volatile memory (RAM), terminate active sessions.
Silver Ticket Detected	Critical (Workload)	Isolate server, reset host computer/service account password.
Golden Ticket Detected	EMERGENCY (T0)	Initiate forest recovery protocol: consecutive double `krbtgt` password reset.
DCSync Detected (Event 4662)	EMERGENCY (T0)	Sever network path to caller, commence enterprise-wide secret rotation.

Rapid Triage Tooling

PowerShell Rapid Classifier:

param([string]$Username)

$DomainSID = (Get-ADDomain).DomainSID.Value
$User = Get-ADUser -Filter "SamAccountName -eq '$Username'" -ErrorAction SilentlyContinue

if (-not $User) {
    Write-Warning "[!] Account absent from domain directory. Suspect local SAM or Golden Ticket."
} else {
    Write-Host "[+] Verified Domain Account: $($User.DistinguishedName)"
    Write-Host "[+] Domain SID: $($User.SID)"
}

Key Takeaways

Triage must immediately differentiate between local SAM and domain authentications.
Kerberos lacking Event 4768 = Golden Ticket; Kerberos lacking any DC events = Silver Ticket.
A network logon (4624 Type 3) represents an active threat only when accompanied by concrete execution (5145, 7045, 4688).