Cheat sheet
Active Directory
The vocabulary and authentication mechanisms to know to understand a Windows domain and read its logs.
CJCADefence
Vocabulary
| Term | Definition |
|---|---|
| Domain | A set of objects (users, machines, groups) sharing a directory database. |
| Domain controller (DC) | Server that hosts the directory and authenticates users. |
| Forest | One or more domains sharing a schema and a global catalog. |
| Trust | Relationship allowing accounts of one domain to access resources of another. |
| OU | Organizational unit: a container to organise objects and apply GPOs. |
| GPO | Group Policy Object: settings applied to users and machines. |
| NTDS.dit | The directory database on each domain controller. |
| SYSVOL | Share replicated across DCs, holding scripts and GPOs. |
| SPN | Service Principal Name: a service's identifier for Kerberos. |
| krbtgt | The account whose key encrypts and signs every TGT in the domain. |
| SID | Unique security identifier of each object. |
| ACL / ACE | An object's access control list, made of entries (ACEs) that grant rights. |
Sensitive groups
| Group | Power |
|---|---|
| Domain Admins | Administrators of the whole domain. |
| Enterprise Admins | Administrators of the whole forest (root domain). |
| Schema Admins | Can modify the forest schema. |
| Administrators | Local administrators of the domain controllers. |
| Backup Operators | Can back up sensitive files from the DCs. |
| DnsAdmins | Manage the DNS service of the domain controllers. |
To monitorAny addition to these groups (Event IDs 4728, 4732, 4756) should trigger an alert.
Kerberos authentication
- AS-REQ / AS-REPThe client proves its identity to the KDC and receives a TGT (4768).
- TGS-REQ / TGS-REPWith its TGT, it requests a ticket for a specific service (4769).
- AP-REQIt presents that service ticket to the target server.
- The KDC (Key Distribution Center) runs on the domain controllers, port 88.
- Pre-authentication requires the client to encrypt a timestamp with its key before getting a TGT.
- Kerberos is time-sensitive: a clock skew of more than 5 minutes (default) makes authentication fail.
NTLM
- An older challenge-response protocol, used when Kerberos is not possible (access by IP address, machine outside the domain).
- Three messages: negotiation, server challenge, response computed from the password hash.
- Validation logged by event 4776.
- Good practice: restrict or disable NTLM, enforce SMB and LDAP signing.
Common attacks and their traces
| Attack | Trace in the logs |
|---|---|
| Kerberoasting | Many 4769 with RC4 encryption (0x17) to service accounts. |
| AS-REP roasting | 4768 for accounts without pre-authentication. |
| Password spraying | Many 4625 or 4771, one password tried on many accounts. |
| DCSync | 4662 with replication rights, from a machine that is not a DC. |
| Golden Ticket | Tickets with abnormal lifetimes or attributes; the only real fix: reset the krbtgt account twice. |
For the investigation process, see Windows logs and Sysmon.