Transitive Trust and Breaking Trust Transitivity: AD Security 101

This post focuses on obtaining domain administrative privileges from a local administrator or domain user account. Once the initial steps have been taken to obtain local administrative access on a Windows operating system, the natural next steps are to gain domain user and domain administrative privileges.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Unconstrained delegation lets a service impersonate users across the domain; attackers hunt such servers, capture Kerberos TGTs with Rubeus, and move laterally. Mechanics and remediation covered.

AS-REP Roasting targets accounts with Kerberos pre-authentication disabled: attackers request an encrypted response and crack it offline. The post shows finding and fixing them with Purple Knight.

Password spraying tests a few weak passwords across many accounts, dodging lockouts; Microsoft ties over a third of compromises to it. Covers delayed and Kerberos pre-auth variants plus detection.

Overpass the Hash converts a captured NTLM hash into fresh Kerberos tickets, giving attackers an authenticated session beyond Pass the Hash. Details the Mimikatz technique, detection, and defenses.