Active Directory · Learn

What is trust relationship abuse?

Domain and forest trusts let users cross boundaries. Attackers abuse them to climb from a compromised domain into its parent or a trusting forest, often reaching Enterprise Admin.

Active Directory · LearnAll services Download PDF
TL;DR

Trust relationship abuse uses Active Directory trusts to escalate across domain and forest boundaries. With control of one domain, an attacker forges an inter-realm ticket using the trust key, or injects a privileged SID (ExtraSids) that SID filtering should strip but often does not within a forest, to gain rights in the trusting domain, commonly climbing from a child domain to Enterprise Admin in the forest root. Defend by enforcing SID filtering on external and forest trusts and treating the forest, not the domain, as the security boundary.

By John Dill, Red Team Lead, SecureLayer7Updated

What trust relationship abuse is

Trusts let users in one domain access resources in another. That convenience carries risk: the key material and SID-based authorization behind a trust can be abused to make a compromised domain's tickets valid in a trusting domain. Because the domain is not a strong security boundary within a forest, controlling one domain often means a path to the entire forest.

How the attack works

A common chain is child-to-parent: with Domain Admin in a child domain the attacker forges a Golden Ticket that adds the Enterprise Admins SID via ExtraSids (mimikatz kerberos::golden /sids=<EA SID> or Rubeus), and because intra-forest SID filtering is off by default, the forged ticket is accepted in the forest root, granting Enterprise Admin. Cross-forest, an attacker with the trust key can forge inter-realm TGTs to move into the trusting forest. Shown for defensive testing.

How to defend against it

Treat the forest, not the domain, as your security boundary, and design tiering accordingly. Enforce SID filtering (quarantine) on external and, where feasible, intra-forest trusts so injected SIDs are dropped, rotate trust keys, monitor for inter-realm TGTs and unexpected ExtraSids, and minimise and audit the trusts you actually need.

References

  1. [1]MITRE ATT&CK Enterprise Matrix(MITRE ATT&CK)
  2. [2]Microsoft: How Active Directory domain trusts work(Microsoft)
Related terms

A trust you forgot about can hand an attacker your whole forest. Talk to a security expert about auditing your domain and forest trusts.

Related service
Red Team Assessment
Goal-based adversary emulation across your people, apps, and network, the full path an attacker would take.
Red team assessment

FAQ

Trust relationship abuse, asked often

Scope an engagement

Test your Active Directory before an attacker does.

Our red team maps the real path from a foothold to domain dominance, and ships findings with reproducible attacks and fixes your team can implement.