noPac: sAMAccountName Spoofing to Domain Admin

Before anything unusual happens in the Kerberos logs, the Active Directory audit trail shows a machine account appearing out of nowhere. A low-privilege user created it. Establish who created it and what their account type tells you about the attack's starting point.

Minutes after the machine account appears, the DC's audit log records a name change on that same account. The new name chosen by the attacker is the key to the whole exploit. Locate the Windows Security event that records this rename and extract the name the attacker set.

Within seconds of the rename, a Kerberos TGT was requested for the spoofed name. This is the moment the KDC cache race is exploited. Determine the Windows Security event ID that records this TGT issuance.

Armed with the spoofed TGT, the attacker invoked a Kerberos extension to request a service ticket on behalf of a domain admin. The SIEM records this request. Identify the domain admin account that was impersonated in this ticket.

With domain admin access secured, the attacker used the obtained ticket to replicate every credential from the DC. A very specific directory access GUID in the audit log identifies this exact operation. Map it to its MITRE ATT&CK technique.

Every attack event in the Kerberos and replication logs originates from a single internal source. That source is the compromised workstation from which the entire exploit chain was launched. Identify it.

The entire attack chain rests on a pair of patched CVEs. The phase that turns a spoofed TGT into a domain-admin service ticket maps to a specific MITRE ATT&CK technique. Name it.