AD Active Trust Attack — SID History and Inter-Realm TGT Intervention
When trust key theft is suspected, SID History is actively abused, or a forged inter-realm TGT is confirmed, rotate the trust key, clear sIDHistory, and escalate to the krbtgt reset playbook if domain/forest compromise is verified.
netdom trust /EnableSIDHistory:no.Prepare
9 steps- Trust Inventory
Document all trust relationships and keep them up to date: `Get-ADTrust -Filter * | Select-Object Name, TrustType, TrustDirection, TrustAttributes`
- SID Filtering Status
Decode TrustAttributes bits for each trust; record Quarantine (0x4), Selective Auth (0x10), WithinForest (0x20) status against an approved baseline: `Get-ADObject -Filter {objectClass -eq 'trustedDomain'} -Properties TrustAttributes | Select-Object Name, @{n='Quarantine';e={($_.TrustAttributes -band 0x4) -ne 0}}, @{n='SelectiveAuth';e={($_.TrustAttributes -band 0x10) -ne 0}}, @{n='EnableTGTDeleg';e={($_.TrustAttributes -band 0x200) -ne 0}}`
- sIDHistory Inventory
If migration is complete, scan and clear the sIDHistory attribute on all accounts: `Get-ADUser -Filter * -Properties sIDHistory | Where-Object {$_.sIDHistory}`
- ForeignSecurityPrincipals Inventory
Document the FSP container and flag residual objects: `Get-ADObject -SearchBase "CN=ForeignSecurityPrincipals,DC=corp,DC=local" -Filter * -Properties *`
- EnableTGTDelegation Status
Confirm that the 0x200 bit is zero on forest trusts after KB4490425; the default should be No on patched DCs