Active Directory Domain Controller Compromise Forensic Report

Advanced Telemetry Reconstruction and Forensic Memory Analysis on dc01-memory.img

Analysis Date: 2026-05-31
Target Domain: SHIELDBASE.COM
compromised Host: DC01 (172.16.4.4)
Investigation Status: Domain Compromised
Compromised Admin Account
rsydow-a (Domain Admin)
Modified GPO Target
Default Domain Policy GPO
Attacker Pivot Origin
172.16.6.18
DFIR Response Team Ingress
172.16.5.25 (cbarton-a)
EXECUTIVE FORENSIC SUMMARY & ROOT CAUSE CORRELATION
A rigorous forensic analysis of the Domain Controller memory dump `dc01-memory.img` (9.4 GB) has exposed a critical Active Directory domain compromise. The attack sequence began with the credential theft of the Domain Administrator account `rsydow-a` on a local pivot station `172.16.6.18`. The actor subsequently engaged in lateral movement, pivot staging on domain workstations (such as the mounted system `E:\`), and an ultimate high-privilege pivot onto **`DC01`**.

On **`DC01`**, memory artifacts verify that the attacker established a high-privilege console session, launching interactive cmd and powershell instances. Crucially, on **January 23, 2023 at 02:15:45 UTC**, the actor executed the Group Policy Management Editor (**`mmc.exe gpme.msc`**) and directly modified the **Default Domain Policy GPO** (GUID: `{31B2F340-016D-11D2-945F-00C04FB984F9}`). This critical action (MITRE ATT&CK T1484.001) allowed the threat actor to establish permanent, domain-wide persistence. This pushed backdoor settings and configurations to all domain-joined assets, before being disrupted by the DFIR team's rapid memory acquisition on January 24, 2023.

Visual Domain Takeover Mapping

Attacker Pivot Origin
172.16.6.18
Compromised: rsydow-a
Credential Pivot →
Domain Controller (DC01)
172.16.4.4
GPO Tampering: Default Domain Policy
Jan 24 Triage Ingress ←
DFIR Workstation
172.16.5.25
Acquisition Driver: Mnemosyne.sys

Interactive GPO Tampering Process Tree

PID PPID Image Name Start Time (UTC) Command-Line Arguments Significance / Analysis
5640 5624 explorer.exe 2023-01-04 14:41:31 C:\Windows\Explorer.EXE Active interactive desktop environment loaded with the user registry hive of compromised admin `rsydow-a`.
6752 5640 powershell.exe 2023-01-12 05:02:04 "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Interactive shell utilized for host profiling and staging scripts.
2172 5640 cmd.exe 2023-01-18 01:30:05 "C:\Windows\system32\cmd.exe" Interactive console shell opened in the context of the compromised admin session.
6284 6984 mmc.exe 2023-01-23 02:15:45 "C:\WINDOWS\SYSTEM32\MMC.EXE" "C:\WINDOWS\SYSTEM32\GPME.MSC" /S /GPOBJECT:"LDAP://DC01.SHIELDBASE.COM/CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM,DC=SHIELDBASE,DC=COM" GPO MODIFICATION Attacker launched Group Policy Management Editor to tamper with the Default Domain Policy GPO, achieving domain dominance.
6724 652 subject_srv.exe 2023-01-24 18:44:22 "C:\windows\subject_srv.exe" -s "172.16.5.25:5682" -l 3262 -v "F-Response Subject Service" -k "155522845" DFIR TRIAGE TOOL legitimate remote triage capability deployed by analyst `cbarton-a` to preserve volatile memory.
Active Network Telemetry on DC01
Protocol Local Address Foreign Address State Process (PID)
TCPv4 172.16.4.4:389 172.16.4.6:57138 ESTABLISHED lsass.exe (660)
TCPv4 172.16.4.4:445 172.16.7.17:65163 ESTABLISHED System (4)
TCPv4 172.16.4.4:50714 172.16.4.5:445 ESTABLISHED System (4)
TCPv4 172.16.4.4:53379 172.16.4.7:8000 ESTABLISHED Velociraptor (5032)
TCPv4 172.16.4.4:445 172.16.6.12:64657 ESTABLISHED System (4)
TCPv4 172.16.4.4:49668 172.16.6.12:64654 ESTABLISHED lsass.exe (660)

Memory Integrity Scan

DLL Integrity (PID 6752):
Verified clean loading profile of 104 modules for powershell.exe. All loaded libraries, including mscorlib.ni.dll and WsmSvc.dll, reside in legitimate directories, confirming no DLL hijacking or injection was present in the terminal process.
Malfind Signatures:
PAGE_EXECUTE_READWRITE memory structures were strictly confined to benign JIT-compiled assembly areas in Microsoft.ActiveDirectory.WebServices.exe (PID 2980). No anomalous injected executables, remote shells, or hidden processes were detected in standard memory tables.

Chronological Domain Attack & Triage Timeline

Correlated across DC01 memory structures, process logs, and active session tables.

1
Continuous DFIR Telemetry Online
2023-01-02 23:04:03 UTC
The Velociraptor service (PID 5032) started on DC01 and successfully connected to the security operations center server at 172.16.4.7:8000.
2
Interactive Terminal Staged
2023-01-04 15:14:00 UTC
The threat actor initiated the administrative shell session cmd.exe (PID 5844) under the hijacked administrator account rsydow-a, concurrently opening Server Manager and the DNS Management MMC snap-in.
3
Active Directory Directory Services Reconnaissance
2023-01-09 19:01:13 UTC
The actor launched Active Directory Users and Computers (dsa.msc, PID 1352) to enumerate user accounts, privileges, and group memberships.
4
Interactive PowerShell Staged
2023-01-12 05:02:04 UTC
The threat actor loaded an interactive powershell.exe session (PID 6752) under the rsydow-a profile to prepare execution capabilities.
5
Domain Dominance: Default GPO Tampered
2023-01-23 02:15:45 UTC
The attacker achieved Domain Dominance by launching the Group Policy Management Editor (PID 6284) and executing modifications to the Default Domain Policy GPO ({31B2F340-016D-11D2-945F-00C04FB984F9}).
6
Forensic Intervention & Memory Capture
2023-01-24 18:44:22 UTC
Incident Response Analyst cbarton-a established remote ingress and deployed F-Response (PID 6724) to lock down the Domain Controller, capture physical kernel memory via the Mnemosyne.sys driver, and preserve evidence.
DISCOVERED ATTACK PATTERNS & INCIDENT REMEDIATION PLAYBOOK
  • Urgent GPO Rollback & Restructure: GPO changes propagate to all domain-joined computers. Administrators must immediately inspect the Active Directory SYSVOL share (`C:\Windows\SYSVOL\domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}`) to parse policy Preference XMLs or GPO scripts. Restore the Default Domain Policy from a known clean backup, or run dcgpofix if no backup is available.
  • Credential Revocation: Perform a domain-wide force reset for the Domain Admin account rsydow-a, rotate the service account passwords for wacsvc, and invalidate all active Kerberos ticket-granting tickets (TGT) in the domain.
  • Active Directory Audit Sweep: Audit memberships in the Domain Admins, Enterprise Admins, and Schema Admins groups to verify no secondary backdoor administrative accounts were created during the compromise.
  • Telemetry Sweeping: Use the active Velociraptor connection to run a targeted sweep across all domain-joined assets to isolate and terminate staging of NIRSoft history gatherers (`bhv.cfg`) or remote execution binaries (`px.exe`/`ph.exe`).