Threat Hunting in Active Directory: Detecting Shadow Admins and Golden Ticket Attacks

Active Directory (AD) remains the primary target for enterprise cyber attacks. Because it controls access to corporate assets and credentials, compromising AD gives threat actors full control over the network. In most breaches, the transition from initial access to full domain compromise happens in under two hours.

To defend against this rapid lateral movement, security operations center (SOC) analysts must shift from reactive alert monitoring to proactive threat hunting. In this comprehensive guide, we detail how to identify "Shadow Admins" and detect Kerberos-based persistence techniques like Golden Tickets.

Understanding Shadow Admins

Shadow Admins are users who are not members of standard administrative groups (such as Domain Admins, Enterprise Admins, or Administrators) but possess specific delegation rights that allow them to gain administrative control. These rights are granted via Active Directory Access Control Lists (ACLs) and often remain hidden from standard security audits that only check group memberships.

Common Delegation Vectors

Threat actors actively hunt for these specific Active Directory extended rights to escalate privileges:

1. GenericAll: Allows complete control over the target object. If a regular user has GenericAll over a Domain Admin account, they can simply reset the Admin's password and log in.
2. WriteDacl: Allows the attacker to modify the permissions of the target object. An attacker can grant themselves GenericAll rights, paving the way for complete takeover.
3. WriteOwner: Allows a user to take ownership of an object. Once an object is owned, the owner can modify its permissions.
4. AllExtendedRights: Allows resetting passwords, forcing replication, and performing DCSync attacks.
5. ForceChangePassword: A highly specific right that allows an attacker to change a user's password without knowing their current password.

Detecting Shadow Admins using BloodHound

Proactive detection of Shadow Admins requires graphing the relationships and ACLs within AD. BloodHound is the industry standard for this task. By ingesting data via the SharpHound collector, security teams can run built-in cypher queries such as Find Principals with DCSync Rights or Find Shortest Paths to Domain Admins to map out hidden delegation paths and identify Shadow Admins before attackers exploit them.

---

Detecting Golden Ticket Attacks

A Golden Ticket is a forged Kerberos Ticket Granting Ticket (TGT) created by compromising the Key Distribution Center (KDC) service account (krbtgt). Since the krbtgt account encrypts all TGTs, possessing its NTLM hash allows an attacker to forge a valid TGT for any user (even non-existent ones), granting them indefinite, stealthy persistence across the domain.

The Mechanics of the Attack

1. The attacker gains Domain Admin privileges and extracts the krbtgt NTLM hash using tools like Mimikatz (via DCSync).
2. The attacker forges a TGT offline, specifying a custom validity period (often 10 years).
3. The forged ticket is injected into the attacker's current session.
4. The attacker can now access any service in the domain without ever communicating with the Domain Controller to authenticate.

Threat Hunting Query for Kerberos Anomalies

Use the following Kusto Query Language (KQL) query in your SIEM (e.g., Microsoft Sentinel) to detect anomalies related to Kerberos ticket lifespans. Default ticket lifetimes are typically 10 hours; forged tickets often have extreme durations.

SecurityEvent
| where EventID == 4768 // Kerberos TGT Request
| extend TicketLifetime = datetime_diff('minute', todatetime(TargetTime), todatetime(StartTime))
| where TicketLifetime > 600 // Filter tickets lasting longer than 10 hours
| project TimeGenerated, Computer, TargetUserName, IpAddress, TicketLifetime
| order by TicketLifetime desc

Critical Detection Checklist

Security engineers should continually audit their event logs for these patterns:

• Audit Event ID 4624 (Logon) with Logon Type 3 (Network) for accounts that do not exist in AD (a common mistake attackers make when forging Golden Tickets).
• Monitor Event ID 4662 indicating write access to Domain Object permissions or DCSync requests.
• Watch for TGTs requested with RC4 encryption (Ticket Encryption Type 0x17) in environments where AES is the enforced standard.
• Set up alerts for DCSync replication requests originating from non-domain controllers (Event ID 4662 on the domain root).

---

Hardening Recommendations

To mitigate Active Directory privilege escalation and persistence, organizations must implement robust architectural changes.

Implement the Tiered Administrative Model

The most effective defense against credential theft and lateral movement is the Tiered Administrative Model:

1. Tier 0 (Control Plane): Houses Domain Controllers, Domain Admins, and identity management systems. Credentials here must never be used on Tier 1 or Tier 2 machines.
2. Tier 1 (Server Plane): Houses enterprise servers, database systems, and application services.
3. Tier 2 (Workstation Plane): Houses enterprise laptops, user workstations, and printers.

Rotate the KRBTGT Password

To invalidate existing Golden Tickets, you must reset the krbtgt account password. However, because AD caches the previous password to prevent immediate authentication failures, you must rotate the krbtgt password twice (with enough time between resets to allow for replication).

Continual ACL Auditing

Perform regular audits of your AD ACLs using tools like BloodHound or PingCastle. Remove unnecessary delegation rights and ensure that administrative accounts are placed in Protected Users security groups to prevent NTLM credential caching.

Conclusion

Active Directory is the keys to the kingdom for most enterprises. By understanding how attackers exploit hidden delegation paths to become Shadow Admins, and how they leverage the krbtgt hash to forge Golden Tickets, security teams can transition from reactive defense to proactive threat hunting. Implement strict tiering, audit your ACLs, and monitor Kerberos anomalies to secure your domain.