Attacks on directory and trust
Techniques that go after the directory itself: Kerberos ticket forgery, certificate services, federation trust, and forest-to-forest compromise. When these fall, everything that trusts them falls with them.
Why this control fails
A directory is a trust anchor, so a bug in Kerberos ticket validation, PKINIT certificate mapping, or federation trust configuration does not compromise one account, it compromises the assumption every downstream system relies on. The 2024-2026 run of Active Directory Certificate Services and PAC validation issues showed the same pattern as SAML signature wrapping: a service checks one part of a credential and trusts another part it never verified. Constrained delegation and forest trusts extend that risk across boundaries, so a weakness patched on one domain controller can still be exploited through a trust path to a domain that has not been patched yet.
What security people should do
- Enforce strong certificate mapping on every domain controller and audit NTAuth and certificate templates for the escalation paths that let a certificate mint a ticket.
- Patch Kerberos-related domain controller updates as a single train across the whole forest, not one domain controller at a time.
- Alert on unexpected service principal name writes and non-standard SPN characters, and restrict who can create or edit them.
- Inventory and prune constrained delegation and cross-forest trust paths that a modern authentication flow could replace.
Techniques in this category
A certificate template with permissive enrollment rights or a misconfigured extension turns Active Directory Certificate Services into a path to domain compromise, no password or Kerberos ticket required.
A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.
Any authenticated domain user can request a Kerberos service ticket for any service principal, and that ticket is encrypted with the service account's own password hash, offline and unrateable to test.
Delegation lets a service act as the user who called it, which is necessary for multi-tier applications and dangerous the moment the service or the delegation scope is not exactly what an administrator intended.