Skip to content
Hermes Codex

Active Directory DFIR Investigation Cheat Sheet and Matrix

1. Critical Windows Event IDs in Active Directory DFIR

Section titled “1. Critical Windows Event IDs in Active Directory DFIR”
Event IDChannel / ProviderForensic Operational MeaningKey Fields to Inspect
4624Security (Host/DC)Successful LogonLogonType, LogonProcessName, TargetUserSid, IpAddress
4625Security (Host/DC)Failed Logon AttemptStatus, SubStatus (e.g., 0xC000006A bad password)
4627Security (Host)Token Group MembershipsGroupMembership (SIDs injected during token creation)
4662Security (DC)Directory Service Object Access (DCSync)Properties (1131f6ad-9c07... = DCSync GUID)
4672Security (Host)Special Privileges AssignedPrivilegeList (SeDebugPrivilege, SeBackupPrivilege)
4675Security (DC)SIDs Filtered During Trust TraversalFilteredSIDs (sIDHistory injection attempt blocked)
4720Security (DC/Host)User Account CreatedTargetUserName, SubjectUserName
4728Security (DC)Member Added to Global Security GroupMemberName, TargetUserName
4732Security (DC/Host)Member Added to Local Group (FSP / Admin)MemberName (DistinguishedName or FSP SID)
4768Security (DC)Initial Kerberos TGT RequestTargetUserName, TicketOptions, PreAuthType
4769Security (DC)Kerberos TGS Request (Service or Referral)ServiceName (krbtgt/*), TicketEncryptionType (0x17)
4776Security (DC)Netlogon Credential Validation (NTLM)PackageName, TargetUserName, Status
7045System (Host)New Service Installed (PsExec, smbexec)ServiceName, ImagePath
8004NTLM/Operational (DC)Forwarded NTLM Netlogon AuthenticationUserName, DomainName, DirectTarget

2. Windows Logon Types Decoded

Section titled “2. Windows Logon Types Decoded”
TypeDesignationTechnical ContextAssociated Attack Vector
2InteractiveLocal console / keyboard logonCredential dumping from LSASS memory
3NetworkSMB, RPC, WMI, HTTP connectionLateral movement, Pass-the-Hash, NetExec
4BatchScheduled task execution under service accountHardcoded credentials in Task Scheduler
5ServiceWindows Service startLocal privilege escalation
7UnlockSession unlock by userConfirmation of physical presence
8NetworkCleartextIIS basic authentication with cleartext credentialsNetwork credential sniffing
9NewCredentialsrunas /netonly executionMimikatz / Overpass-the-Hash signature
10RemoteInteractiveRemote Desktop Protocol (RDP) sessionInteractive session hijacking and memory theft

3. Rapid Kerberos Attack Classification Matrix

Section titled “3. Rapid Kerberos Attack Classification Matrix”
┌──────────────────┬──────────────────────┬────────────────────────┬────────────────────────┐
│ Attack Vector    │ Compromised Key      │ Operational Blast      │ Characteristic DC Log  │
├──────────────────┼──────────────────────┼────────────────────────┼────────────────────────┤
│ Golden Ticket    │ krbtgt (Domain)      │ Full Forest (Tier 0)   │ Event 4769 WITHOUT 4768│
│ Silver Ticket    │ Host / Service Key   │ Single Service Only    │ ZERO telemetry on DCs  │
│ DCSync           │ Replication Rights   │ Full NTDS Database Dump│ Event 4662 (Rep GUID)  │
│ Kerberoasting    │ Weak Service Password│ Offline TGS Cracking   │ Event 4769 burst (RC4) │
│ AS-REP Roasting  │ No Pre-Auth Account  │ Offline TGT Cracking   │ Event 4768 PreAuth=0   │
└──────────────────┴──────────────────────┴────────────────────────┴────────────────────────┘

4. The 6 Vital PowerShell Commands During an Incident

Section titled “4. The 6 Vital PowerShell Commands During an Incident”

1. Enumerate Domain Admins and Enterprise Admins

Section titled “1. Enumerate Domain Admins and Enterprise Admins”
Terminal window
Get-ADGroupMember -Identity "Domain Admins" -Recursive | Select-Object Name, SamAccountName, ObjectClass
Get-ADGroupMember -Identity "Enterprise Admins" -Recursive | Select-Object Name, SamAccountName

2. Identify Unconstrained Delegation Hosts

Section titled “2. Identify Unconstrained Delegation Hosts”
Terminal window
Get-ADComputer -Filter {TrustedForDelegation -eq $True} | Select-Object Name, DNSHostName

3. List All External Accounts with Local Permissions (FSPs)

Section titled “3. List All External Accounts with Local Permissions (FSPs)”
Terminal window
Get-ADObject -SearchBase "CN=ForeignSecurityPrincipals,DC=domain,DC=local" -Filter * -Properties memberOf |
  Select-Object Name, whenCreated, memberOf

4. Audit SID Filtering Quarantine Status

Section titled “4. Audit SID Filtering Quarantine Status”
Terminal window
netdom trust LOCAL_DOMAIN /Domain:REMOTE_DOMAIN /quarantine

5. Audit Principals Possessing DCSync Permissions

Section titled “5. Audit Principals Possessing DCSync Permissions”
Terminal window
Get-Acl "AD:\DC=domain,DC=local" | Select-Object -ExpandProperty Access |
  Where-Object { $_.ActiveDirectoryRights -match 'ExtendedRight' -and $_.ObjectType -eq '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' }

6. Hunt Recently Modified GPO Templates in SYSVOL

Section titled “6. Hunt Recently Modified GPO Templates in SYSVOL”
Terminal window
Get-ChildItem -Path "\\$env:USERDNSDOMAIN\SYSVOL\$env:USERDNSDOMAIN\Policies" -Recurse |
  Sort-Object LastWriteTime -Descending | Select-Object -First 15 FullName, LastWriteTime

5. Emergency Incident Remediation Matrix

Section titled “5. Emergency Incident Remediation Matrix”
Crisis ScenarioImmediate Action (Hour 0)Intermediate Action (Hour 2)Full Recovery (Day 1)
DCSync or Golden TicketIsolate source pivot hostFirst krbtgt password resetSecond krbtgt reset + rotate trust keys
Fleet Pass-the-Hash (SAM)Network-isolate impacted hostsEnforce LAPS across 100% of fleetSet LocalAccountTokenFilterPolicy = 0
Entra Connect CompromiseBlock attacker IP on DCsReset on-premise MSOL_ accountReset cloud sync account & credentials
Weaponized SYSVOL GPOUnlink malicious GPOPurge files from SYSVOLForce gpupdate /force enterprise-wide

Key Takeaways

Section titled “Key Takeaways”
  • Identity $\rightarrow$ Authentication $\rightarrow$ Authorization $\rightarrow$ Access $\rightarrow$ Action: Never skip an investigative step.
  • The SID is the only immutable identity anchor resilient against account renaming and spoofing.
  • Consecutive double krbtgt rotation respecting replication latency is the only method to eradicate Golden Tickets.
  • Endpoint log collection is indispensable: local NTLM and Silver Tickets never appear on domain controllers.

References & Further Reading

Section titled “References & Further Reading”