Trust relationship abuse uses Active Directory trusts to escalate across domain and forest boundaries. With control of one domain, an attacker forges an inter-realm ticket using the trust key, or injects a privileged SID (ExtraSids) that SID filtering should strip but often does not within a forest, to gain rights in the trusting domain, commonly climbing from a child domain to Enterprise Admin in the forest root. Defend by enforcing SID filtering on external and forest trusts and treating the forest, not the domain, as the security boundary.
What trust relationship abuse is
Trusts let users in one domain access resources in another. That convenience carries risk: the key material and SID-based authorization behind a trust can be abused to make a compromised domain's tickets valid in a trusting domain. Because the domain is not a strong security boundary within a forest, controlling one domain often means a path to the entire forest.
How the attack works
A common chain is child-to-parent: with Domain Admin in a child domain the attacker forges a Golden Ticket that adds the Enterprise Admins SID via ExtraSids (mimikatz kerberos::golden /sids=<EA SID> or Rubeus), and because intra-forest SID filtering is off by default, the forged ticket is accepted in the forest root, granting Enterprise Admin. Cross-forest, an attacker with the trust key can forge inter-realm TGTs to move into the trusting forest. Shown for defensive testing.
How to defend against it
Treat the forest, not the domain, as your security boundary, and design tiering accordingly. Enforce SID filtering (quarantine) on external and, where feasible, intra-forest trusts so injected SIDs are dropped, rotate trust keys, monitor for inter-realm TGTs and unexpected ExtraSids, and minimise and audit the trusts you actually need.
References
- [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
- [2]Microsoft: How Active Directory domain trusts work(Microsoft)
A trust you forgot about can hand an attacker your whole forest. Talk to a security expert about auditing your domain and forest trusts.