Topic starter
04/09/2026 6:46 pm
TL;DR: A forged Kerberos ticket with SID history let an attacker cross from a child domain into the forest root and dump every credential in the environment, according to FireCompass. The chain shows that trusting domain boundaries as security boundaries still fails when trust filtering is missing and admin isolation is weak.
Editorial analysis by NHI Mgmt Group, based on content published by FireCompass: “Attack chain walkthrough: Forest root domain compromise via golden ticket with SID history”.
Key questions
Q: What breaks when SID filtering is not enforced on an Active Directory trust?
A: A forged Kerberos ticket can carry a privileged SID across the trust boundary and be accepted in a higher-trust domain.
Q: Why does child-domain admin access sometimes lead to forest-wide compromise?
A: Child-domain admin access can expose replication rights and krbtgt material, which lets an attacker mint tickets that survive normal logon controls.
Q: What signs suggest Active Directory trust paths are too exposed?
A: Warning signs include broad machine-account creation rights, direct workstation-to-domain-controller reachability, and limited monitoring of Netlogon authentication flows.
Practitioner guidance
- Enforce SID filtering on every inter-domain trust Verify quarantine settings on child-to-root and forest trusts, then confirm that extra SIDs are stripped before they can be honoured by the forest root.
- Isolate forest-root administration with tiered access Keep forest-root credentials and administrative workflows separate from child-domain admin paths so a child compromise cannot be reused upward.
- Treat krbtgt rotation as a two-domain recovery task After a golden ticket event, rotate krbtgt in both domains and validate that no cached trust path still accepts the forged ticket claims.
Bottom line: SID history abuse turns a forged Kerberos ticket into a cross-domain privilege path when trust filtering is missing.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/09/2026 6:46 pm
SID filtering was the broken governance assumption, not the ticket itself. The attack worked because the trust assumed foreign privilege claims would be stripped before they reached the forest root. That assumption fails when inter-domain quarantine is disabled, and the implication is that trust relationships have to be governed as identity control surfaces, not just network plumbing.
A question worth separating out:
Q: How should teams recover after a golden ticket with SID history attack?
A: Contain the trust path first, then rotate krbtgt in every affected domain and verify that forest-root administration is isolated from child-domain access. Recovery is incomplete until the same forged ticket can no longer be accepted anywhere in the forest.
👉 Read our full editorial: Forest root compromise via golden ticket SID history abuse