skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-active-directory-compromise-investigation

Investigate Active Directory compromise by analyzing authentication logs, Kerberos tickets, and replication metadata.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#lateral movement#golden ticket#DFIR#Active Directory#Kerberos#DCSync
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-active-directory-compromise-investigation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-active-directory-compromise-investigation
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/incident-response/performing-active-directory-compromise-investigation
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-active-directory-compromise-investigation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

When attackers breach Active Directory, responders struggle to determine how access was gained, what persistence was established, and how far the compromise spread. This Skill provides a structured methodology to reconstruct the attack chain from authentication logs, Kerberos activity, replication metadata, and Group Policy changes.

Core Features & Use Cases

  • Kerberos Attack Detection: Identify Golden Ticket, Silver Ticket, and Kerberoasting activity through Event IDs 4768/4769 anomalies, encryption downgrades, and abnormal ticket lifetimes.
  • NTDS.dit and DCSync Detection: Spot credential database exfiltration via Event ID 4662 replication GUIDs, shadow copy creation, and DRSUAPI traffic from non-DC hosts.
  • Persistence and Remediation Planning: Audit AdminSDHolder ACLs, SID History, krbtgt password age, and privileged group changes, then execute a phased remediation plan including krbtgt double-rotation.
  • Use Case: After detecting suspicious service ticket requests on a domain controller, use this Skill to trace lateral movement paths through 4624/4648 logon chains, confirm DCSync via replication GUIDs, and produce a scoped remediation plan.

Quick Start

Investigate a suspected Active Directory compromise by analyzing the domain controller security event logs for Golden Ticket and DCSync indicators.

Frequently Asked Questions about performing-active-directory-compromise-investigation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect a Golden Ticket attack in Active Directory?▼

Detect Golden Tickets by hunting for Event ID 4769 service ticket requests with no preceding 4768 AS-REQ from the same account, RC4 encryption (0x17) in AES-only environments, tickets referencing disabled accounts, and ticket lifetimes exceeding the 10-hour default.

How to identify DCSync attacks using Windows event logs?▼

Identify DCSync via Event ID 4662 containing replication GUIDs 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 or 1131f6ad from a principal that is not a domain controller. Cross-check with repadmin /showrepl and netflow for DRSUAPI traffic from non-DC hosts.

What tools are used for Active Directory compromise investigation?▼

Common tools include BloodHound for attack path mapping, Pingcastle and Purple Knight for AD risk assessment, Impacket for DCSync detection, Velociraptor for remote forensic collection, and Timeline Explorer for event log analysis.

Why does a clean authentication log not rule out Active Directory compromise?▼

A forged Golden Ticket is minted offline with the krbtgt hash, so it generates no 4768 event and can appear as normal 4769 activity. Only a krbtgt double-reset reliably invalidates forged tickets, so log review alone cannot confirm a clean state.

What are the limitations of detecting Silver Ticket attacks on domain controllers?▼

Silver Tickets forge service tickets directly, producing no 4768 or 4769 events on the domain controller. Detection must occur at the target service host by correlating local logon events 4624/4672 that lack corresponding DC Kerberos events.

Related Skills

Explore More Software Engineering Skills→
ersinkocersinkoc
2

Log Analysis and Anti-Forensics

Analyze Linux and Windows logs to detect timestomping and verify log integrity.

Community
Advanced
AcczdyAcczdy
2

performing-service-account-audit

Inventory service accounts across AD, cloud IAM, databases, and applications and classify risk from ownership, privileges, password posture, and activity.

Community
Advanced
jaskaranhundaljaskaranhundal
3

threat-hunting

Execute hypothesis-driven, IOC-driven, and anomaly-driven threat hunting across endpoint, network, and cloud telemetry.

Community
Advanced
mitchuskimitchuski

agentprivacy-forensic-defense

Contain privacy breaches, preserve evidence, and assess key material damage.

Community
Advanced