Notifications
Clear all
Topic starter
04/09/2026 6:46 pm
TL;DR: A forged Kerberos ticket with SID history let an attacker cross from a child domain into the forest root and dump every credential in the environment, according to FireCompass. The chain shows that trusting domain boundaries as security boundaries still fails when trust filtering is missing and admin isolation is weak.
NHIMG editorial — based on content published by FireCompass: Attack chain walkthrough, forest root domain compromise via golden ticket with SID history
Questions worth separating out
Q: What breaks when SID filtering is not enforced on an Active Directory trust?
A: A forged Kerberos ticket can carry a privileged SID across the trust boundary and be accepted in a higher-trust domain.
Q: Why do golden ticket attacks become more severe when SID history is injected?
A: SID history lets the attacker claim membership in groups that belong to another domain, so the forged ticket does more than impersonate an account.
Q: How should teams detect forest-wide risk after a child-domain compromise?
A: Look for replication rights abuse, unusual ticket forgery patterns, and administrative actions that cross from child domains into the forest root.
Practitioner guidance
- Enforce SID filtering on every inter-domain trust Validate that trust quarantine is enabled and tested, then document exceptions with compensating controls.
- Reduce and monitor replication privileges Treat DCSync-capable rights as a privileged exception, not a routine admin entitlement.
- Separate forest-root administration from child-domain administration Keep forest-root credentials in a dedicated administrative tier and remove routine operational paths from child-domain admins to the root.
What's in the full article
FireCompass's full blog covers the operational detail this post intentionally leaves for the source:
- The exact Windows trust setting and command sequence used to enable SID quarantine across the inter-domain trust.
- The step-by-step offensive workflow for extracting krbtgt material and forging the ticket with the injected SID.
- The recovery sequence for double-rotating krbtgt in both domains without breaking directory operations.
- The attack-path diagram and root-cause discussion that show why isolated controls miss forest-wide compromise.
👉 Read FireCompass's walkthrough of forest root compromise via golden ticket SID history abuse →
Golden ticket SID history abuse: what breaks at forest trust boundaries?
Explore further
04/09/2026 6:46 pm
Domain boundaries are not security boundaries in Active Directory. The article shows that a child-domain compromise can become a forest compromise when trust filtering is weak. That is a governance failure, not just a technical bug, because the security programme has misidentified the real boundary of control. Practitioners should evaluate the forest as the unit of trust, not the domain.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Our research also shows that only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
A: Yes. Forest-root administration needs its own tier, its own credentials, and its own recovery plan because compromise at that level changes the recovery problem entirely. If root control depends on the same paths as child-domain administration, the trust model is already too flat to contain a cross-domain attack.
👉 Read our full editorial: Forest root compromise via golden ticket SID history abuse
