ADTRUST-008: Foreign Domain Trust Enumeration
- Plataforma
- Active Directory
- Categoría
- AD Trust Relationships
- Severidad
- Medium
- Pilar de Zero Trust
- Identity (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
The check enumerates every trustedDomain object across every domain in the forest and applies a foreign-trust filter. A trust is classified as foreign when one or more of the following is true: - trustAttributes does not have the WITHIN_FOREST bit (0x20) set, meaning the trust is not an intra-forest shortcut, parent-child, or tree-root trust. - trustType equals 1 (TRUST_TYPE_DOWNLEVEL, an NT4-style trust to a Windows NT domain) or 3 (TRUST_TYPE_MIT, a Kerberos realm trust to a non-Windows KDC such as MIT Kerberos or Heimdal). - trustAttributes has the TREAT_AS_EXTERNAL bit (0x40) set, indicating a forest trust that the administrator has explicitly downgraded to external-trust semantics. - The securityIdentifier of the trusted domain does not match any domain SID under the local forest root, confirming the partner is in a different forest entirely. For each foreign trust the check captures: trustPartner (the DNS name of the foreign domain), trustDirection (1 Inbound, 2 Outbound, 3 Bidirectional), trustType (1 NT, 2 AD Uplevel, 3 MIT, 4 DCE), the full trustAttributes bitmask, securityIdentifier, whenCreated, whenChanged, and the msDS-SupportedEncryptionTypes value on the trust account. It then evaluates the SID filtering state (SIDFilteringQuarantined for external trusts, SIDFilteringForestAware for forest trusts), the TGT delegation state (CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION bit 0x800), the selective authentication state (CROSS_ORGANIZATION bit 0x10), and whether the trust still uses RC4 encryption (USES_RC4_ENCRYPTION bit 0x80). Each foreign trust is reported with the full set of attributes plus a derived risk classification: Hardened (SID filter on, TGT delegation off, selective auth on, AES keys), Standard (SID filter on, TGT delegation off, AES keys), or At-Risk (any of those mitigations absent).
Por qué importa
The trusting organization can audit and remediate misconfigurations inside its own forest. It cannot do the same on the other side of a foreign trust. Every foreign trust is therefore a transitive risk: the security posture of the partner becomes part of the local attack surface, and a compromise of the partner becomes a compromise path into the local environment. The specific failure modes that foreign trusts introduce: - Cross-forest SID history injection. With krbtgt of the foreign forest, an attacker can forge an inter-realm TGT containing an Enterprise Admin SID of the local forest in the ExtraSids field. If SID filtering is not enforced on the trust (SIDFilteringQuarantined false on an external trust, SIDFilteringForestAware off on a forest trust), the local DC honors the SIDs and grants Tier-0 access. Mandiant has attributed multi-tenant breaches to this primitive against partners with weaker security baselines. - Forgotten partner trusts. External trusts to acquired-and-divested businesses, decommissioned partners, or merged subsidiaries persist in trustedDomain long after the business relationship ended. The trusted DC may be sinkholed, repurposed, or in some cases reclaimed by an attacker who registers the lapsed DNS namespace. - TGT delegation across organizational boundaries. CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x800) lets a service in the foreign forest receive a full TGT for a local user via Kerberos delegation. A compromised resource on the foreign side can then replay that TGT against any service in the local forest. - MIT realm trusts. A trust to a third-party Kerberos KDC (trustType 3) is outside Windows account policy, outside Windows logging, and outside the local IAM lifecycle entirely. A compromise of the MIT KDC is a direct path to forge tickets that local DCs will accept. - Downlevel NT trusts. trustType 1 indicates an NT4-era trust object. These predate SID filtering and Kerberos entirely and rely on NTLM with no AES support; in any modern environment their continued existence is a regression worth investigating. Foreign trust enumeration is the prerequisite control for the contractual security baseline. The legal, procurement, and risk functions cannot enforce SID filtering, encryption uplift, or annual partner attestation on trusts they do not know exist.
Ruta de ataque
Step 1: Reconnaissance from any authenticated foothold. The attacker runs Get-ADTrust -Filter * -Properties * (or nltest /domain_trusts /all_trusts /v) and parses trustAttributes for the WITHIN_FOREST bit. Any trust without that bit is a foreign trust and a candidate path. PowerView Get-DomainTrust -SearchScope Forest and SharpHound -CollectionMethod Trusts produce the same view. Step 2: Partner reachability check. For each foreign trust, the attacker probes the trusted side: DNS resolution of the partner domain, LDAP bind to a DC of the partner, and netdom trust /verify. Trusts to namespaces that no longer resolve, or whose DCs are unreachable, are flagged as forgotten-trust opportunities (the attacker can then attempt namespace takeover via expired DNS or sinkholed networks). Step 3: SID-filter assessment. The attacker reads trustAttributes for QUARANTINED_DOMAIN (0x4) on external trusts and queries the foreign-aware SID-filter state via Get-ADTrust. If SID filtering is off, the trust is selected as a SID-history injection target. Step 4: Cross-forest compromise of the partner. The attacker pivots to the foreign forest through whatever path is cheapest: phishing a foreign user, exploiting a partner-side vulnerability, or abusing an inbound trust the partner has from yet a third party. The local forest provides no defense once the partner is compromised, because the trust delegates authentication authority by design. Step 5: SID history injection. With krbtgt of the foreign forest extracted (mimikatz lsadump::dcsync /domain:partner.local /user:krbtgt), the attacker forges an inter-realm TGT containing the SID of an Enterprise Admin group in the local forest: mimikatz kerberos::golden /user:Administrator /domain:partner.local /sid:<partner-sid> /krbtgt:<partner-krbtgt-hash> /sids:S-1-5-21-<local-root>-519 /service:krbtgt /target:local.contoso.com. Equivalent Impacket invocation: ticketer.py -nthash <krbtgt> -domain-sid <partner-sid> -domain partner.local -extra-sid S-1-5-21-<local>-519 Administrator. Step 6: Cross-realm referral. The attacker presents the forged inter-realm TGT to a DC in the local forest, receives a service ticket for any resource in the trusting domain, and operates with Enterprise Admin rights. Detection is difficult because the authentication arrives over a legitimate, well-known trust path. Step 7: TGT delegation abuse (alternate path, when 0x800 is set on the trust). The attacker, controlling any service in the foreign forest, induces a local user to authenticate to it (PetitPotam, malicious link, printer-bug coercion). The full TGT for the local user is delegated to the foreign service, which extracts it from LSA and replays it against local resources.
Cómo lo evalúa Guerrilla
Guerrilla iterates through (Get-ADForest).Domains and binds to each domain with Get-ADTrust -Filter * -Server $domain -Properties *. For each returned trust object it computes the foreign-trust predicate: (trustAttributes -band 0x20) -eq 0 (WITHIN_FOREST clear) OR trustType -in @(1,3) OR (trustAttributes -band 0x40) -eq 0x40. When the AD PowerShell module is not available, the collector falls back to an LDAP query against (objectClass=trustedDomain) under CN=System,<domain DN> and decodes the bitmask manually using the constants from MS-ADTS section 6.1.6.7.9. For each foreign trust the check resolves the partner domain SID, queries DNS for the partner namespace to flag unresolvable trusts, and computes a derived risk classification by combining the SID filtering state, TGT delegation bit, selective authentication bit, and encryption-type support. The collector does not require elevated rights on the local side: trustedDomain objects are readable by Authenticated Users. It does not attempt to bind to or enumerate the foreign side, so partner-side security posture is reported as "unknown, requires external attestation" rather than inferred. Output is one row per foreign trust feeding the downstream ADTRUST-002, ADTRUST-003, and ADTRUST-004 checks.
Valor recomendado
All foreign domain trusts documented with external security assessment, contractual security requirements, and annual review
Remediación
Identify trusts with domains outside the organization using Get-ADTrust -Filter *. For each external trust, verify that a security agreement is in place, SID filtering is enabled, selective authentication is configured, and the trust is reviewed annually
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-20, CA-3, SA-9
- CIS AD Benchmark
- 3.1.4
- MITRE ATT&CK
- T1482, T1078.002