AD-FOREIGN-SPLateral Movement

Foreign Security Principal Abuse

Add a foreign principal (cross-forest SID) to a local domain group — bypass cross-trust filtering when misconfigured.

§ Where this technique fits

AD-FOREIGN-SP is catalogued under the Lateral Movement tactic of the offensive-security kill-chain. It appears in 0 approved dossiers in the registry, typically.