Three Footholds, One Forest: Ranking Tier-0 Risk
Contoso Manufacturing runs a single AD forest with 4,200 users and 1,100 servers across three sites. A red-team engagement reported two footholds: a helpdesk workstation and a build server. The blue team has three facts. First, 38 service accounts have SPNs registered; 31 are ordinary user accounts whose passwords were last set in 2016, and the domain still permits RC4_HMAC_MD5 for a legacy ERP integration. Second, LAPS is deployed to member servers, but a GPO precedence error left 60 file servers in an OU where the LAPS client rotates the password successfully, yet the same local Administrator password is also configured as a separate recovery account on all 60 hosts. Third, the domain has 14 Domain Admin accounts, and three of them have active interactive sessions on the build server, which also has direct outbound internet access. EDR flagged 4769 events with encryption type 0x17 from one workstation against 12 distinct SPNs within four minutes. No alerts fired for 4624 type 3 logons between workstations.
1. Rank the three facts by how quickly each converts to domain compromise. Justify the ordering.
Read the worked answer
Fastest: the three Domain Admin sessions on an internet-connected build server. Any code execution or local admin on that host converts to domain compromise in minutes - LSASS dumping or a DCSync using the stolen token - and a build server with direct egress is the most externally reachable of the footholds. The presence of privileged interactive logons on a host that talks to the internet is the single worst fact here.
Second: Kerberoasting. Any authenticated low-privilege user can request service tickets for the 31 SPN-bearing user accounts and crack them offline. RC4 (0x17) is materially cheaper to crack than AES, but the root cause is a 2016-era password, not the cipher - an AES ticket with the same password still falls. This path is high-likelihood but slower, because cracking is unattended and never touches the network again.
Last: local admin reuse on 60 file servers. By itself it is a lateral-movement amplifier scoped to those hosts and does not reach tier 0 immediately. But it interacts badly with the other two: a cracked service account that is also local admin on a file server becomes a durable, low-noise foothold. The pairing is what makes the estate fragile, so fix it as a pair - unique local admin credentials per host is not optional once Kerberoastable accounts exist.
2. Write the detection logic for the observed Kerberoasting pattern and name the two controls that most reduce exposure, including their operational caveats.
Read the worked answer
Detection: alert on 4769 where TicketEncryptionType = 0x17 and ServiceName is not krbtgt and not a machine account, baselined per requesting host. The observed shape - one workstation, 12 SPNs, four minutes - is textbook, so a distinct-SPN-count threshold over a five-minute window catches it with few false positives. Add a rule for a host requesting TGS tickets far outside its normal peer set, and for 4769 with 0x12/0x13 from hosts that normally request nothing. One caveat matters: enforcing AES removes the 0x17 signal entirely, so the detection must shift to TGS volume and breadth before you flip that switch, or you go blind exactly when you fix the exposure.
Controls. First, migrate to group Managed Service Accounts wherever the workload supports it - machine-managed 240-character passwords with no crackable material and no human rotation burden. Second, for accounts that cannot be gMSA, set a 40+ character random password and pin msDS-SupportedEncryptionTypes to AES128+AES256. Caveats: RC4 cannot be disabled domain-wide while the ERP integration still negotiates it, so confirm with 4769 logs before enforcing, or you break month-end. gMSA also does not work for accounts that need interactive logon or that span an unsupported platform. Finally, strip SPNs from accounts that no longer need them; an SPN is a crackable artifact you get for free.
3. The build server has live Domain Admin sessions and internet egress. Give the containment order, and explain which step people most often get wrong.
Read the worked answer
Isolate the host at the security-group or NACL layer, not by shutting it down or disabling the EDR agent - you want memory and logs, and a powered-off host is a destroyed scene. Snapshot first if the platform allows.
Treat the three Domain Admin accounts as compromised: rotate passwords twice, purge their Kerberos tickets, and pull them from privileged groups pending review. Then hunt for 4662 with the replication GUIDs 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 and 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2, for 4624 type 3 crossing tiers, and for 4769 against krbtgt.
The step teams get wrong is skipping the krbtgt reset. If DA credentials sat on a compromised, internet-connected host, a DCSync may already have occurred, and host isolation does nothing about a stolen golden ticket. Reset krbtgt twice, spaced beyond the maximum replication interval plus margin (commonly ~10 hours plus safety), with the second reset only after the first has replicated, in a change window. It breaks existing tickets and will generate noise; that is the cost of invalidating a golden ticket.
The structural fix follows: build agents live in their own tier with no interactive privileged logons and no direct internet egress beyond approved artifact mirrors. Without that, you will be back here next quarter.