Recovering a compromised domain
When an attacker has become domain admin, you determine the scope, clean up persistence, safely reset krbtgt and privileged accounts and, if needed, recover the forest from backup.
Level 501 · 12 lessons · 12 practice labs
Lessons
Assessment
- Scoping a domain compromise
- AD persistence: hidden admins, SID history, AdminSDHolder
- Clean up or rebuild
- Short task: find the four persistence points the attacker left
Recovery
- Resetting the krbtgt password twice, safely
- Rotating privileged and service account passwords
- Forest recovery: authoritative restore
- Re-securing trusts and certificate services
- Short task: reset krbtgt without stopping services
Afterwards
- Intensive monitoring after recovery
- Lessons learned and lasting improvements
- Capstone: take back a compromised CORP.LAB with a 48-hour plan
Practice labs
- Classify the evidence that shows how far a compromise went: Label ten given findings as single-host, privileged-account or whole-domain level and pick the weightiest piece of evidence.
- Establish from events how much privilege the attacker reached: Review privileged logons, replication requests and group changes and decide whether the krbtgt key must be treated as exposed.
- Make a justified call between cleaning up and rebuilding: Fill in a decision table weighing backup age, persistence findings and outage cost, and write a one-page recommendation to Demirsu Enerji’s management.
- Find newly created accounts added to privileged groups: Compare accounts created in the last 30 days with additions to privileged groups and flag the one nobody can explain.
- Uncover persistence in SID history and on AdminSDHolder: Find an account carrying a privileged SID in its SID history and a foreign entry added to the AdminSDHolder access list, and clean up both.
- Find and prove the four persistence points the attacker left: Expose a hidden admin, a replication right, a GPO script and a changed service account password with directory queries and events, writing evidence and a clean-up step for each.
- Read the krbtgt account’s password age and version number: Query the krbtgt account’s last password change date and key version number and confirm they match on both domain controllers.
- Reset the krbtgt password once without stopping services: Check replication health, reset the password, confirm the change reached the second domain controller and show ticket issuing continues.
- Sequence the double krbtgt reset with privileged password rotation: Plan the two resets with a wait based on ticket lifetime and the order of admin and service account rotations, carry it out in the lab and prove an old ticket is rejected.
- Identify the domain controller to restore and the age of its backup: Find the latest good system state backup, its date and the domain controller it belongs to from the backup records.
- Bring back a deleted OU with an authoritative restore: Restore the backup in Directory Services Restore Mode, mark the deleted OU authoritative and verify it replicates to the second domain controller.
- Set up intensive monitoring for the first 48 hours after recovery: After re-securing the trust password and certificate services, build three alerts for old accounts, old tickets and new privileged memberships and demonstrate each firing.
About this course
When an attacker has become domain admin, you determine the scope, clean up persistence, safely reset krbtgt and privileged accounts and, if needed, recover the forest from backup.
What you will learn
- Assessment
- Recovery
- Afterwards
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.