Skip to content
Attack Paths
← RegistryDossier · 6 steps · 5 edges

Cross-trust attack: child → parent forest via SID History

Forge an inter-realm TGT using a child domain's krbtgt and inject Enterprise Admins SID into SID History to traverse a non-quarantined trust.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: attacker is Domain Admin in a child domain. Parent trust is intra-forest (transitive) and SID filtering is not enforced (typical for parent-child in the same forest).

§ Steps

  1. 01
    Child Domain AdminInitial Access
    T1078— Valid Accounts
  2. 02
    Request TGS in parentCredential Access
    T1558— Steal or Forge Kerberos Tickets

    Asktgs against parent KDC using the forged inter-realm ticket.

  3. 03
    Recover Enterprise Admins SIDDiscovery
    T1482— Domain Trust Discovery

    S-1-5-21-<root>-519

  4. 04
    Forge inter-realm TGT with SID HistoryCredential Access
    T1558.001— Golden Ticket

    mimikatz kerberos::golden /sids:S-1-5-21-<root>-519 /service:krbtgt /target:<parent>

  5. 05
    DCSync on parent DCCredential Access
    T1003.006— DCSync
  6. 06
    DCSync child krbtgtCredential Access
    T1003.006— DCSync

§ References

§ Frequently asked

What is the "Cross-trust attack: child → parent forest via SID History" attack path?
Forge an inter-realm TGT using a child domain's krbtgt and inject Enterprise Admins SID into SID History to traverse a non-quarantined trust. It chains 6 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Child Domain Admin (T1078) — a initial access primitive. Assumed environment: attacker is Domain Admin in a child domain.
What is the final impact of this kill-chain?
The final step lands on DCSync child krbtgt (T1003.006), which falls under Credential Access. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers