Kerberoasting: Service Ticket to Domain Admin

You have been paged on suspicious activity touching corp-wks-002, and the first discipline of triage is separating attacker traffic from routine business noise. Early in the day this host made an outbound DNS lookup from its email client that needs to be reviewed and cleared as expected baseline behavior before you commit time to the real intrusion. Review the network telemetry for the host and identify the exact remote server address the mail client resolved.

With the routine traffic ruled out, turn to the real lead: EDR flagged an unusual execution chain on corp-wks-002 where a third-party command-line utility spawned a series of system shells. Somewhere at the bottom of that chain an interpreter was launched to run an attacker script — and identifying it anchors everything that follows. Reconstruct the process hierarchy on the host and name the interpreter that was spawned as a child of the command shell.

Having pinned the interpreter at the root of the chain, the next question is what it actually ran. The interpreter was invoked with a command line pointing at a script staged in a temporary directory — that script is the tooling the adversary used to operate against the environment. Inspect the endpoint telemetry for the interpreter process and recover the exact filename of the script it executed.

You now know the interpreter and the script it ran, but to track this process across the rest of the telemetry you need a precise handle on it. The execution chain on corp-wks-002 runs from the third-party utility through a command shell down to the process that actually carried out the attacker's action. Reconstruct that chain in the XDR process tree and report the process identifier of the final-stage process.

The final-stage process did not stay on corp-wks-002 — immediately after it launched, it reached out across the internal network to begin moving toward higher-value infrastructure. Establishing which system it targeted defines the scope of the breach and tells you where the attacker went next. Review the endpoint and network telemetry around the execution and identify the internal server the tooling connected to.

You have established that the tooling moved from the workstation to the internal server; now characterize how that connection was made. The protocol and service it rode in on tell you what the attacker was abusing for remote execution and credential operations, which shapes both your detection logic and your containment. Examine the single successful connection from the final-stage process to the internal server and determine the network service it used.

Days after the lateral movement, the operators returned to their objective: collection and exfiltration. Archiving activity on dc-prod-01 bundled user documents, and shortly afterward the host opened an outbound session to a system outside the corporate estate. Recovering that destination is what lets you assess data loss and feed the indicator to blocking and threat intel. Analyze the network event messages following the archiving activity and determine where the data was being sent.

The last thread to close is the attacker's most recent interactive activity on corp-wks-002. After the exfiltration, monitoring flagged hands-on-keyboard behavior under anita.garcia's account — a lightweight process the operator launched directly to read or stage files on the box. Pinning this down confirms how late the intruder was still active and completes your timeline. Analyze the SIEM process-create events for this user and host and determine which process the attacker launched.