What it does. Investigate Active Directory compromise by analyzing authentication logs, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/performing-active-directory-compromise-investigation/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-active-directory-compromise-investigation, or copy the skill folder into ~/.claude/skills/performing-active-directory-compromise-investigation/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-active-directory-compromise-investigation/SKILL.md

SKILL.md (verbatim)

name: performing-active-directory-compromise-investigation
description: Investigate Active Directory compromise by analyzing authentication logs,
  replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify
  attacker persistence and lateral movement paths.
domain: cybersecurity
subdomain: incident-response
tags:
- active-directory
- compromise-investigation
- identity-forensics
- kerberos
- lateral-movement
- dfir
- ntds-dit
- golden-ticket
mitre_attack:
- T1486
- T1490
- T1070
- T1078
- T1021
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Application Protocol Command Analysis
- Network Isolation
- Network Traffic Analysis
- Client-server Payload Profiling
- Platform Monitoring
nist_csf:
- RS.MA-01
- RS.MA-02
- RS.AN-03
- RC.RP-01

Performing Active Directory Compromise Investigation

Overview

Active Directory (AD) compromise investigation is a critical incident response capability that focuses on identifying how attackers gained access to domain services, what persistence mechanisms they established, and the scope of credential compromise. Since 88% of breaches involve compromised credentials (Verizon 2025 DBIR), AD is the primary target for enterprise-wide attacks. Investigators must analyze NTDS.dit database integrity, Kerberos ticket-granting activity, Group Policy modifications, replication metadata, and privileged group membership changes to reconstruct the attack chain and determine full compromise scope.

When to Use

• When conducting security assessments that involve performing active directory compromise investigation
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

Prerequisites

• Familiarity with incident response concepts and tools
• Access to a test or lab environment for safe execution
• Python 3.8+ with required dependencies installed
• Appropriate authorization for any testing activities

Key Investigation Areas

1. NTDS.dit Database Analysis

The NTDS.dit file is the core Active Directory credential database containing all password hashes for domain accounts. Attackers commonly exfiltrate this file using tools like ntdsutil, secretsdump.py, or DCSync attacks via Mimikatz.

Detection indicators:

• Event ID 4662: Access to directory service objects with replication permissions
• Event ID 4742: Computer account modifications on domain controllers
• Volume Shadow Copy creation on domain controllers (Event ID 8222)
• Unusual ntdsutil.exe or vssadmin.exe execution
• Replication traffic from non-DC sources (DCSync detection)

2. Kerberos Attack Detection

Golden Ticket indicators:

• TGT tickets with abnormally long lifetimes (default is 10 hours)
• Event ID 4769 with encryption type 0x17 (RC4) instead of AES
• TGT issued without corresponding Event ID 4768 (AS-REQ)
• Kerberos tickets referencing non-existent or disabled accounts

Silver Ticket indicators:

• Service tickets without corresponding TGT requests
• Event ID 4769 with unusual service names
• Tickets with forged PAC data

Kerberoasting indicators:

• High volume of Event ID 4769 for service accounts
• RC4 encryption requests for accounts that support AES
• Requests from workstations not normally accessing those services

3. Group Policy Abuse

• GPO modifications granting new privileges (Event ID 5136)
• Scheduled task deployment via GPO
• Software installation policies added to domain
• Login script modifications
• Registry-based policy changes for persistence

4. Privileged Group Enumeration

Track modifications to these critical groups:

• Domain Admins, Enterprise Admins, Schema Admins
• Account Operators, Backup Operators
• DnsAdmins (can execute arbitrary DLLs on DCs)
• Group Policy Creator Owners
• Protected Users group membership changes

5. Trust Relationship Analysis

• New forest/domain trusts created (Event ID 4706)
• SID History injection for privilege escalation
• Trust ticket forgery indicators
• Cross-domain authentication anomalies

Investigation Methodology

Phase 1: Scoping and Evidence Collection

1. Identify potentially compromised domain controllers
2. Collect Security, System, Directory Service event logs
3. Extract AD replication metadata using repadmin
4. Capture ntdsutil snapshots for offline analysis
5. Collect DNS server logs and zone transfer records
6. Export Group Policy Object configurations
7. Document current privileged group memberships

Phase 2: Authentication Log Analysis

1. Parse Event ID 4624/4625 for logon patterns
2. Identify pass-the-hash indicators (Event ID 4624 Type 3 with NTLM)
3. Analyze Event ID 4768/4769/4771 for Kerberos anomalies
4. Review Event ID 4776 for NTLM authentication failures
5. Cross-reference logon events with known compromised accounts
6. Map lateral movement paths through authentication chains

Phase 3: Persistence and Backdoor Detection

1. Enumerate AdminSDHolder ACL modifications
2. Check for SID History abuse on accounts
3. Verify krbtgt account password age
4. Audit DSRM password configuration
5. Check for skeleton key malware indicators
6. Review AD Certificate Services for rogue certificates
7. Validate DNS records for poisoning

Phase 4: Remediation Planning

1. Double-rotate krbtgt password (wait replication between rotations)
2. Reset all compromised account passwords
3. Remove unauthorized privileged group members
4. Revoke rogue certificates if AD CS compromised
5. Rebuild domain controllers from clean media if needed
6. Implement tiered administration model
7. Enable Protected Users group for privileged accounts

Critical Event IDs for AD Investigation

Event ID	Source	Description
4624	Security	Successful logon
4625	Security	Failed logon
4648	Security	Explicit credential logon
4662	Security	Operation on AD object
4768	Security	Kerberos TGT requested
4769	Security	Kerberos service ticket requested
4771	Security	Kerberos pre-authentication failed
4776	Security	NTLM credential validation
5136	Security	Directory object modified
5137	Security	Directory object created
4706	Security	Trust created
4707	Security	Trust removed
4742	Security	Computer account changed
8222	System	Shadow copy created

Tools for AD Investigation

Tool	Purpose
BloodHound	Attack path mapping and privilege escalation analysis
Pingcastle	AD security assessment and risk scoring
Purple Knight	AD vulnerability scanning by Semperis
ADRecon	Active Directory data gathering
Mimikatz	Credential extraction and Kerberos analysis
Impacket	DCSync detection and NTLM relay analysis
Velociraptor	Remote forensic artifact collection
Timeline Explorer	Event log timeline analysis

MITRE ATT&CK Mapping

Technique	ID	Relevance
DCSync	T1003.006	NTDS.dit credential extraction
Golden Ticket	T1558.001	Kerberos TGT forgery
Silver Ticket	T1558.002	Service ticket forgery
Kerberoasting	T1558.003	Service account hash extraction
Pass-the-Hash	T1550.002	NTLM hash reuse
Group Policy Modification	T1484.001	Persistence via GPO
Account Manipulation	T1098	Privileged group changes
SID-History Injection	T1134.005	Privilege escalation

References

• CISA: Detecting and Mitigating Active Directory Compromises
• Microsoft: Total Identity Compromise IR Lessons
• Semperis: Top 10 Active Directory Risks
• Fidelis: Active Directory Compromise Response

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Active Directory Compromise Investigation Report Template

Case Information

Field	Details
Case ID	IR-AD-YYYY-XXX
Investigator
Date Initiated
Organization
Domain(s) Affected
Domain Controllers
Estimated Compromise Date

Executive Summary

[Brief description of the AD compromise, scope, and critical findings]

Scope of Investigation

Domain Controllers Examined

DC Name	OS Version	IP Address	Role	Status

Log Sources Collected

• Security Event Logs (all DCs)
• System Event Logs
• Directory Service Logs
• DNS Server Logs
• PowerShell Transcription Logs
• Replication Metadata
• GPO Configuration Export
• Privileged Group Membership Export

Attack Timeline

Timestamp	Event	Source	Severity
	Initial access
	Privilege escalation
	Lateral movement
	Domain compromise
	Data access/exfiltration

Findings

Finding 1: [Attack Category]

• Severity: CRITICAL / HIGH / MEDIUM / LOW
• Evidence: [Event IDs, log entries, artifacts]
• Impact: [Accounts, systems, data affected]
• MITRE ATT&CK: [Technique ID and name]

Finding 2: [Attack Category]

• Severity:
• Evidence:
• Impact:
• MITRE ATT&CK:

Compromised Accounts

Account	Type	Privileges	Compromise Method	Status
	Domain Admin		DCSync	Disabled
	Service Account		Kerberoasting	Reset

Kerberos Analysis

Golden Ticket Assessment

• krbtgt password age: _____ days
• TGTs with abnormal lifetimes detected: Yes / No
• RC4 encryption on tickets detected: Yes / No
• Service tickets without TGT requests: Yes / No

Kerberoasting Assessment

• Bulk TGS requests from single source: Yes / No
• Service accounts with weak passwords: Yes / No
• Service accounts targeted: _____ accounts

Lateral Movement Map

[Source] --> [Hop 1] --> [Hop 2] --> [Domain Controller]
   |
   +--> [Hop 1b] --> [File Server]

Persistence Mechanisms Found

• AdminSDHolder ACL modifications
• SID History injection
• Rogue GPO policies
• Skeleton Key malware
• DCShadow objects
• Rogue AD CS certificates
• Scheduled tasks via GPO
• Modified login scripts
• Custom WMI subscriptions

Remediation Actions

Immediate (0-24 hours)

• Disable all compromised accounts
• Isolate compromised systems
• Block attacker IP addresses at firewall
• Double-rotate krbtgt password
• Revoke all active sessions

Short-term (24-72 hours)

• Reset all privileged account passwords
• Reset all service account passwords
• Remove unauthorized group memberships
• Revert malicious GPO changes
• Remove persistence mechanisms

Long-term (1-4 weeks)

• Force all user password changes
• Implement tiered administration model
• Deploy Privileged Access Workstations
• Enable Microsoft Defender for Identity
• Implement LAPS for local admin passwords
• Configure advanced audit policies
• Add critical accounts to Protected Users group

Indicators of Compromise

Accounts

Account	Type	Activity

IP Addresses

IP	Activity	First Seen	Last Seen

Tools Detected

Tool	Hash	Location	Purpose

Appendix

Event Log Analysis Summary

BloodHound Attack Path Diagrams

GPO Change Detail

Network Diagram with Lateral Movement Overlay

references/api-reference.md (verbatim)

Active Directory Compromise Investigation - API Reference

Windows Security Event IDs

Event ID	Description	Compromise Indicator
4662	Directory service object accessed	DCSync (replication GUIDs)
4769	Kerberos service ticket requested	Kerberoasting (RC4 encryption)
4768	Kerberos TGT requested	Golden Ticket (anomalous source)
4672	Special privileges assigned	Privileged logon tracking
4624	Successful logon	Lateral movement (Type 3)
4648	Explicit credential logon	Pass-the-hash, PsExec
4720	User account created	Persistence
4728	Member added to global group	Privilege escalation
4732	Member added to local group	Privilege escalation

DCSync Detection

Replication GUIDs (Event 4662 ObjectType)

GUID	Right
1131f6aa-9c07-11d1-f79f-00c04fc2dcd2	DS-Replication-Get-Changes
1131f6ad-9c07-11d1-f79f-00c04fc2dcd2	DS-Replication-Get-Changes-All
89e95b76-444d-4c62-991a-0facbeda640c	DS-Replication-Get-Changes-In-Filtered-Set

When a non-DC account triggers 4662 with these GUIDs, it indicates DCSync attack (Mimikatz lsadump::dcsync).

Kerberoasting Detection

Event 4769 with TicketEncryptionType = 0x17 (RC4-HMAC) for service accounts. Normal behavior uses AES (0x11 or 0x12). RC4 requests by user accounts against service SPNs indicate offline cracking attempts.

Golden Ticket Detection

Event 4768 TGT requests from IPs that are not domain controllers. Golden tickets forged offline will show TGT requests from workstations rather than DCs.

Lateral Movement Detection

• Type 3 logon (Event 4624, LogonType=3): Network logon via SMB, WMI, PsExec
• Event 4648: Explicit credential use (runas, remote tools)
• Pattern: Multiple Type 3 logons from same source to different targets

Event Log JSON Format

The agent accepts JSON-exported event logs:

[
  {
    "EventID": 4769,
    "TimeCreated": "2024-01-15T10:30:00Z",
    "EventData": {
      "TargetUserName": "svc_sql",
      "ServiceName": "MSSQLSvc/db01:1433",
      "TicketEncryptionType": "0x17"
    }
  }
]

Export from PowerShell:

Get-WinEvent -LogName Security | ConvertTo-Json -Depth 5 > events.json

Output Schema

{
  "report": "ad_compromise_investigation",
  "total_events_analyzed": 50000,
  "total_findings": 15,
  "severity_summary": {"critical": 3, "high": 7, "medium": 5},
  "findings": [{"type": "dcsync_detected", "severity": "critical"}]
}

CLI Usage

python agent.py --log events.json --output report.json

references/standards.md (verbatim)

Standards and Frameworks for AD Compromise Investigation

NIST SP 800-61 Rev 2 - Computer Security Incident Handling Guide

• Provides incident response lifecycle: Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity
• AD compromise investigations follow all four phases with emphasis on scoping the identity compromise

CISA Alert: Detecting and Mitigating Active Directory Compromises

• Published guidance on AD-specific threats and detection methods
• Covers DCSync, Golden Ticket, Silver Ticket, and Kerberoasting attacks
• Recommends tiered administration, Protected Users group, and credential hygiene
• Reference: https://www.cisa.gov/resources-tools/resources/detecting-and-mitigating-active-directory-compromises

MITRE ATT&CK Framework - Credential Access Tactics

• T1003.006: OS Credential Dumping - DCSync
• T1558.001: Steal or Forge Kerberos Tickets - Golden Ticket
• T1558.002: Steal or Forge Kerberos Tickets - Silver Ticket
• T1558.003: Steal or Forge Kerberos Tickets - Kerberoasting
• T1550.002: Use Alternate Authentication Material - Pass the Hash
• T1484.001: Domain Policy Modification - Group Policy Modification
• T1098: Account Manipulation

Microsoft Security Best Practices

• Tiered administration model for Active Directory
• Privileged Access Workstations (PAWs) for domain admin tasks
• Microsoft Advanced Threat Analytics (ATA) / Defender for Identity
• LAPS (Local Administrator Password Solution) deployment
• Protected Users security group enforcement
• Reference: https://learn.microsoft.com/en-us/security/privileged-access-workstations/overview

CIS Benchmarks for Active Directory

• CIS Microsoft Windows Server Benchmark for DC hardening
• Password policy requirements (minimum 14 characters)
• Account lockout policy configuration
• Audit policy settings for security event logging
• GPO security baseline configurations

SANS FOR500 - Windows Forensic Analysis

• Windows artifact analysis methodology
• Registry analysis for persistence detection
• Event log forensics for authentication tracking
• Timeline analysis techniques for AD compromise

Semperis Identity Forensics and Incident Response (IFIR)

• AD-specific forensic methodology
• Replication metadata analysis
• Change tracking and rollback capabilities
• Forest recovery procedures
• Reference: https://www.semperis.com/solutions/active-directory-breach-forensics/

Key Windows Security Event IDs for AD Monitoring

• Microsoft documentation on security auditing events
• Advanced Audit Policy Configuration for DCs
• Kerberos event logging requirements
• Directory Service Access auditing

references/workflows.md (verbatim)

AD Compromise Investigation Workflows

Workflow 1: Initial Triage and Scoping

START: AD Compromise Alert Received
  |
  v
[Determine Scope of Potential Compromise]
  |-- Single account compromised?
  |-- Multiple accounts compromised?
  |-- Domain controller compromised?
  |-- Full domain compromise suspected?
  |
  v
[Collect Initial Evidence]
  |-- Export Security event logs from all DCs
  |-- Snapshot AD replication metadata
  |-- Export current GPO configurations
  |-- Document privileged group memberships
  |
  v
[Identify Compromised Accounts]
  |-- Analyze logon events (4624/4625)
  |-- Check for pass-the-hash patterns
  |-- Review Kerberos ticket activity
  |-- Cross-reference with threat intelligence
  |
  v
[Determine Attack Timeline]
  |-- First known malicious activity
  |-- Privilege escalation events
  |-- Lateral movement chain
  |-- Data access and exfiltration
  |
  v
[Report Findings and Escalate]

Workflow 2: Kerberos Attack Investigation

START: Suspicious Kerberos Activity Detected
  |
  v
[Analyze Event ID 4768 - TGT Requests]
  |-- Normal TGT requests from user workstations?
  |-- TGT requests from unusual sources?
  |-- Encryption type analysis (AES vs RC4)
  |
  v
[Analyze Event ID 4769 - Service Ticket Requests]
  |-- High volume from single source? --> Kerberoasting
  |-- Service tickets without prior TGT? --> Silver Ticket
  |-- Unusual service names or SPNs?
  |
  v
[Check for Golden Ticket Indicators]
  |-- TGT lifetime exceeds 10 hours?
  |-- TGT for non-existent accounts?
  |-- TGT without matching AS-REQ?
  |-- krbtgt account age analysis
  |
  v
[Determine Remediation Actions]
  |-- Kerberoasting: Reset affected service account passwords
  |-- Golden Ticket: Double-rotate krbtgt password
  |-- Silver Ticket: Reset affected service account passwords
  |-- All: Review and harden SPN configurations
  |
  v
END: Remediation Complete + Monitoring Enhanced

Workflow 3: DCSync Attack Investigation

START: Replication from Non-DC Source Detected
  |
  v
[Verify Replication Source]
  |-- Is source a legitimate domain controller?
  |-- Check Event ID 4662 for replication rights usage
  |-- Verify account has DS-Replication-Get-Changes-All
  |
  v
[If Unauthorized Replication Detected]
  |-- Identify compromised account with replication rights
  |-- Determine which credentials were replicated
  |-- Check for Mimikatz/Impacket artifacts on source
  |
  v
[Assess Credential Exposure]
  |-- All domain password hashes potentially compromised
  |-- krbtgt hash exposure enables Golden Ticket
  |-- Service account hashes enable Silver Tickets
  |-- Trust keys enable cross-domain attacks
  |
  v
[Execute Full Credential Reset]
  |-- Double-rotate krbtgt (wait for replication)
  |-- Reset all privileged account passwords
  |-- Reset all service account passwords
  |-- Force password change for all users
  |
  v
END: Monitor for Continued Unauthorized Replication

Workflow 4: Post-Compromise Remediation

START: Compromise Scope Determined
  |
  v
[Immediate Containment]
  |-- Disable compromised accounts
  |-- Block attacker IP addresses
  |-- Isolate compromised systems
  |-- Revoke active sessions and tokens
  |
  v
[Credential Reset Sequence]
  |-- Step 1: Reset krbtgt (first rotation)
  |-- Step 2: Wait for full AD replication
  |-- Step 3: Reset krbtgt (second rotation)
  |-- Step 4: Wait for full AD replication
  |-- Step 5: Reset all privileged accounts
  |-- Step 6: Reset all service accounts
  |-- Step 7: Force user password changes
  |
  v
[Persistence Removal]
  |-- Remove unauthorized GPO modifications
  |-- Clean AdminSDHolder ACL entries
  |-- Remove SID History entries
  |-- Revoke rogue AD CS certificates
  |-- Remove skeleton key if detected
  |-- Clean scheduled tasks and services
  |
  v
[Hardening Implementation]
  |-- Deploy tiered administration model
  |-- Enable Protected Users group
  |-- Implement PAW for admin tasks
  |-- Deploy LAPS for local admin
  |-- Configure advanced audit policies
  |
  v
END: Continuous Monitoring Established

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.