Domain Controller Authentication
Domain Controller Authentication [T1556.001]
Last updated
Domain Controller Authentication [T1556.001]
Last updated
Name: Domain Controller Authentication
ID: T1556.001
Tactics: , ,
Technique:
Domain Controller Authentication (T1556.001) is a sub-technique within the MITRE ATT&CK framework categorized under Credential Access. It involves adversaries manipulating authentication processes on domain controllers to capture or forge credentials, enabling persistent access and lateral movement within Active Directory environments. By targeting domain controllers, attackers exploit trust relationships and authentication mechanisms to escalate privileges, maintain persistence, and evade detection.
Domain Controller Authentication techniques involve adversaries leveraging or exploiting authentication mechanisms within Active Directory environments. Attackers typically target domain controllers (DCs), as these servers handle authentication and authorization requests for users, computers, and services within a Windows domain.
Technical details and execution methods include:
Kerberos Authentication Exploitation:
Attackers can leverage Kerberos ticket-granting tickets (TGTs) and service tickets to impersonate legitimate users or services.
Techniques such as Kerberoasting involve extracting encrypted service tickets from memory or network traffic, then offline brute-forcing or cracking them to obtain plaintext credentials.
Golden Ticket attacks involve attackers creating forged TGTs using the compromised Kerberos Ticket Granting Ticket encryption key (krbtgt account hash), granting persistent and unrestricted access to domain resources.
NTLM Authentication Exploitation:
Attackers may intercept NTLM authentication traffic between clients and domain controllers using tools such as Responder or Inveigh, capturing NTLM hashes for offline cracking or relay attacks.
NTLM relay attacks involve forwarding captured NTLM authentication requests to other systems, enabling lateral movement or privilege escalation without needing plaintext credentials.
Pass-the-Hash and Pass-the-Ticket Techniques:
Attackers reuse captured NTLM hashes or Kerberos tickets directly for authentication, bypassing the need for plaintext passwords.
Tools such as Mimikatz, Impacket, and Rubeus are commonly used to execute these attacks.
Real-world procedures typically involve:
Initial compromise of endpoints or privileged accounts to gain initial footholds.
Escalating privileges to gain administrative access to domain controllers.
Extracting credential hashes or tickets from memory, LSASS processes, or network traffic.
Forging authentication requests or tickets to maintain persistent and stealthy access.
Domain Controller Authentication techniques are commonly employed during various stages of cyber-attacks, including:
Credential Access Phase:
Attackers target domain controllers to extract credentials, hashes, or tickets, enabling further lateral movement or privilege escalation.
Persistence Phase:
Golden Ticket attacks provide persistent administrative access to domain resources, allowing attackers to remain undetected for extended periods.
Privilege Escalation and Lateral Movement Phases:
Attackers leverage compromised credentials or forged tickets to move laterally within the network, escalating privileges to domain administrator level.
Defense Evasion Phase:
Attackers exploit trusted authentication mechanisms to blend in with legitimate network traffic, evading detection tools and security monitoring.
Attack scenarios where Domain Controller Authentication is prevalent include:
Advanced Persistent Threat (APT) operations targeting enterprise networks.
Ransomware attacks seeking domain-wide compromise for maximum impact.
Insider threat scenarios where malicious insiders exploit domain-level credentials.
Penetration testing and red team engagements simulating realistic adversarial behaviors.
Detection of Domain Controller Authentication techniques requires a combination of monitoring, logging, and analysis strategies. Common detection methods include:
Monitoring Windows Event Logs:
Analyze domain controller event logs (Security logs) for unusual authentication events, ticket requests, or failed login attempts.
Specifically monitor event IDs related to Kerberos authentication (e.g., 4768, 4769, 4771) and NTLM authentication activities (e.g., event IDs 4624, 4625).
Network Traffic Analysis:
Inspect network traffic for anomalous Kerberos or NTLM authentication requests, especially unusual ticket lifetimes, encryption types, or authentication failures.
Tools such as Wireshark, Bro/Zeek, or Suricata can identify suspicious authentication traffic indicative of pass-the-hash, pass-the-ticket, or Kerberoasting attacks.
Behavioral Analytics and SIEM Solutions:
Utilize Security Information and Event Management (SIEM) systems to correlate authentication events, identify anomalous login patterns, and detect potential credential theft or forgery.
Employ User and Entity Behavior Analytics (UEBA) tools to detect deviations from baseline authentication behaviors, such as unusual account activity or unexpected administrative access.
Endpoint Detection and Response (EDR) and Memory Analysis:
Deploy EDR solutions to detect tools commonly used for credential extraction and ticket forging, such as Mimikatz, Impacket, or Rubeus.
Conduct memory analysis on domain controllers and endpoints to identify injected processes, suspicious DLLs, or in-memory credential extraction activities.
Indicators of Compromise (IoCs):
Presence of tools like Mimikatz, Rubeus, or Impacket on domain controllers or endpoints.
Unusual Kerberos ticket requests or forged tickets with anomalous lifetimes.
Authentication logs indicating repeated failed attempts or unusual NTLM relay activities.
Detection of anomalous administrative access or lateral movement activities across domain resources.
Early detection of Domain Controller Authentication exploitation is critical due to the significant impacts on organizational security and integrity. Possible impacts include:
Credential Compromise and Privilege Escalation:
Attackers gaining administrative privileges can control domain resources, modify security policies, and access sensitive data.
Persistent Access and Long-term Compromise:
Golden Ticket attacks enable attackers to maintain persistent access, bypassing password resets or account lockouts.
Data Exfiltration and Intellectual Property Theft:
Attackers with domain-level access can easily extract sensitive organizational data, intellectual property, or personally identifiable information (PII).
Operational Disruption and Ransomware Deployment:
Domain controller compromise allows attackers to deploy ransomware or destructive malware across the entire domain, causing significant operational disruption and financial loss.
Loss of Trust and Reputational Damage:
Compromise of domain controllers undermines organizational trust, potentially leading to reputational harm, regulatory penalties, and loss of customer confidence.
Therefore, prompt detection and response are essential to minimize damage, secure domain resources, and maintain organizational security posture.
Real-world examples of Domain Controller Authentication exploitation include:
NotPetya Attack (2017):
Attackers leveraged credential theft and lateral movement techniques, including pass-the-hash and pass-the-ticket attacks, to rapidly propagate ransomware across corporate networks, causing billions of dollars in damages worldwide.
Operation Skeleton Key (2015):
Attackers used modified authentication modules installed on domain controllers to bypass legitimate authentication mechanisms, enabling attackers to authenticate as any user without knowing passwords, allowing persistent stealthy access.
APT29 (Cozy Bear) Activities:
APT29 frequently utilized Kerberos ticket manipulation, including Golden Ticket and Kerberoasting attacks, to maintain persistent access within targeted organizations, enabling espionage operations and data exfiltration.
Common tools observed in real-world attacks:
Mimikatz: Credential extraction, pass-the-hash, Golden Ticket creation.
Rubeus: Kerberos ticket extraction and manipulation, Kerberoasting.
Impacket: NTLM relay attacks, pass-the-ticket, authentication exploitation.
Responder/Inveigh: NTLM hash capturing and relay attacks.
Impacts observed in real-world scenarios:
Persistent and stealthy access to sensitive resources.
Significant financial and operational disruption due to ransomware deployment.
Extensive data exfiltration and intellectual property theft.
Long-term compromise and difficulty in remediation efforts due to credential theft and forged authentication mechanisms.