Choosing an AD Path Under EDR and a Change Freeze
Meridian Health, a 2,500-user hospital group, has a single Active Directory forest with five domain controllers and CrowdStrike EDR on all servers and workstations. You have a foothold as low-privilege domain user 'helpdesk1' on a workstation. The client VLAN has no internet egress; only SMB and LDAP to internal servers are allowed. BloodHound shows helpdesk1 has GenericAll over the service account svc_wsus; svc_wsus has constrained delegation to WSUS01 for HTTP; WSUS01 is a management server where Domain Admins log in. BloodHound also shows unconstrained delegation on PRINT01, and a Kerberoastable service account. A clinical-system change freeze starts in 48 hours, the client wants proof of Domain Controller compromise without disrupting patient care, and EDR is known to alert on LSASS access. You have three days on target.
1. Rank the three candidate paths (GenericAll on svc_wsus, unconstrained delegation on PRINT01, Kerberoasting a service account) by risk-adjusted likelihood of reaching Domain Controller proof within 48 hours. Justify with the given constraints.
Read the worked answer
Rank: 1) GenericAll on svc_wsus, 2) Kerberoasting, 3) PRINT01 unconstrained delegation.
GenericAll is first because it is an ACL path, not a memory-access technique. You can reset svc_wsus's password or set an SPN without touching LSASS, which reduces EDR risk. The constrained delegation to WSUS01 for HTTP is the bridge: request a service ticket for WSUS01 and use it to access the management server. The main risk is that requesting a ticket for a delegation target can be logged; you should test during low-activity hours and have a fallback. WSUS01 is valuable because Domain Admins log in there; if true, a ticket capture or local admin on WSUS01 can yield Domain Admin material. 48 hours is enough for one careful attempt.
Kerberoasting is second: it is low-noise and does not require local admin, but cracking time is uncertain. If the service account has a 14+ character password, you may not crack it before the freeze. Use it as a parallel collection step, not the primary path.
PRINT01 unconstrained delegation is third: printer bug/SpoolSample coercion is noisy, often blocked, and can crash the spooler. It also requires a coerced authentication from a Domain Admin. Given clinical systems and the change freeze, the availability risk is too high unless the first two paths fail.
Decision rule: spend the first 8 hours on ACL abuse, run Kerberoasting collection in parallel, and hold PRINT01 as a last resort with client approval.
2. You obtain a ticket for svc_wsus but EDR blocks the first attempt to request a service ticket for WSUS01. What do you change, and what do you document?
Read the worked answer
First, do not repeat the same action at higher volume. EDR blocking a ticket request suggests the tool or behavior is signatured, not necessarily that the path is dead. Options: (1) use a native Windows binary or a less-signatured method to request the service ticket, such as PowerShell with the appropriate .NET classes, or a different user context; (2) check whether the block was on the tool, the command line, or the network; (3) move to a host with a different EDR policy if one exists; (4) if the block is network-based, try from a management VLAN host you already control, within scope.
Before retrying, confirm the delegation configuration with LDAP queries (msDS-AllowedToDelegateTo) so you are not chasing a false positive. Document: timestamp, source host, user context, exact command/tool, EDR alert text if available, and the alternate method tried. If the second attempt also fails, stop and report the control as effective; do not burn the engagement on a blocked technique. The finding becomes 'ACL path exists but EDR controls ticket abuse,' which is still valuable.
3. The client asks whether you can 'just run Mimikatz' on WSUS01 to show Domain Admin credentials. How do you respond and what alternative proof do you offer?
Read the worked answer
I would explain that running Mimikatz on a production management server is high-risk: it accesses LSASS, which CrowdStrike is configured to alert on, and it could trigger an incident response or destabilize the host. The goal is proof of Domain Admin compromise, not a specific tool. Alternatives: (1) use the constrained delegation ticket to access WSUS01 and demonstrate local admin via a benign command (whoami, hostname, ipconfig) and a screenshot; (2) if Domain Admin credentials are cached, use a less invasive method such as checking for admin sessions with native tools, or querying Domain Admins group membership; (3) with client approval, run a controlled LSASS access in a maintenance window with EDR exclusions and an agreed stop condition; (4) prove Domain Controller compromise by authenticating to a DC with a low-privilege account you escalated, using a read-only LDAP query, and documenting the group membership change. I would not run Mimikatz without written approval and a rollback plan. The report should note the control that prevented the technique, because that is a finding too.