PetitPotam: NTLM Relay to AD CS Domain Takeover
An internal workstation coerces a domain controller into authenticating to it, relays that authentication to the AD CS Web Enrollment endpoint, and walks away with a certificate for the domain controller itself. The operator turns that certificate into a domain-controller identity and DCSyncs the entire domain. Work the coercion traffic, the certificate issuance records, and the endpoint telemetry to reconstruct an attack that never fired a single exploit.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the coerced controller
20Overnight, an ordinary internal workstation pulled a domain controller into authenticating to it, the opening move of the whole intrusion. Work the Windows authentication and object-access records and identify the internal host that the domain controller was forced to authenticate to.
Catch the relayed enrollment
20That coerced authentication did not stay put, it was forwarded to a service that hands out trust. Identify the certificate authority host where the coerced domain controller authentication was relayed to the Web Enrollment endpoint.
Name the impersonated identity
25The certificate authority issued a certificate to an identity it should never have handed one to from that source. Identify the account the issued certificate was made out to.
Expose the secrets pull
25Holding a domain-controller identity, the operator reached into Active Directory and replicated its crown jewels. Identify the file the operator wrote out containing the harvested domain secrets.
Classify the credential theft
15With a domain-controller identity in hand, the final move replicated every account secret out of Active Directory. Map that technique to its MITRE ATT&CK identifier.
5 tasks · 105 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allOvernight on the DMZ Wiki
Quillon Software publishes its engineering wiki straight to the internet from the DMZ. Overnight the host picked up work nobody rostered: requests that never authenticated, shell activity under a service account, and outbound sessions from a server that normally only talks to its update mirrors. Work the web access logs, the Linux audit trail and the perimeter egress, and reconstruct what reached the host and what left it.
Brixton Foods: the directory answered a request it should have refused
A food manufacturer's help desk raised a ticket at lunchtime: an overnight production report had not written to the file share, and one workstation had been slow all morning. By the evening the share was unreadable and an administrator account nobody on the IT rota recognises had been busy on the domain controllers. You have the day's Windows Security feed and the endpoint telemetry for the estate. Reconstruct what the operator did between the first mailbox and the unreadable share, and name the accounts and hosts the response team has to act on.
Phishing foothold → domain compromise
A finance user at Vendt Aerospace opened a mail attachment mid-morning, and within the hour an administrative account was signing in to a server it had no business reaching. Work the domain controller's authentication records and the endpoint process telemetry, separate the intrusion from an estate that produces plenty of traffic that looks similar, and reconstruct how the operator got from one workstation to the directory.