Active Directory Domain Controller Forensic Report
Comprehensive Memory Artifact Investigation & Critical Vector Analysis
Incident Overview
A physical memory forensics investigation of the primary Domain Controller `DC01` was performed utilizing the 9.4 GB raw kernel dump `dc01-memory.img`. The investigation revealed a complete compromise of Active Directory domain management capabilities, originating from lateral credential abuse of the high-privilege administrator account `rsydow-a`.
The attack sequence established that the threat actor initially stage-pivoted from the corporate workstation `172.16.6.18` (which was previously fully analyzed via disk forensics on `E:\`). Utilizing harvested credentials of Domain Administrator `rsydow-a`, the actor moved laterally to client machines, pushing remote scripts and administrative utilities, and ultimately established interactive high-privilege console access on the domain controller itself.
Group Policy Tampering & Domain Persistence
The definitive indicator of active domain takeover is visible in memory process trees. On **January 23, 2023 at 02:15:45 UTC**, the threat actor launched the Group Policy Management Editor (**`mmc.exe gpme.msc`**, PID 6284). Memory arguments show they targeted the **Default Domain Policy GPO** (`{31B2F340-016D-11D2-945F-00C04FB984F9}`).
Tampering with the Default Domain Policy GPO is a highly critical action. Because this GPO is automatically evaluated and applied by every domain-joined workstation and member server, modifications allow the attacker to push arbitrary registry changes, disable security controls (like Windows Defender), create persistent service backdoors, or deploy malicious task schedules to the entire enterprise in a single action.
Lateral Movement & Response Vector
Host Environment
- Hostname: DC01
- OS Version: Windows Server 2022
- IP Address: 172.16.4.4
- Domain: SHIELDBASE.COM
- RAM Size: 9.4 GB Physical
Indicators of Compromise
- Attacker Shell: powershell.exe (6752)
- Administrative Pivot: rsydow-a
- Tampered GPO: {31B2F340-016D...}
- Triage Endpoint: 172.16.5.25
Operations Alert
Active threat hunt scanning was successfully deployed via Velociraptor (PID 5032) back to management endpoint `172.16.4.7:8000`. Memory collection was completed via F-Response to ensure court-admissible custody chain preservation.
DFIR Sensor Service Initialized
The Velociraptor security agent service (PID 5032) started execution on the Domain Controller. It established an active network socket connection back to the triage server at 172.16.4.7:8000. This provided a baseline of continuous forensic telemetry on host actions.
Initial Terminal Shell Opened
The threat actor initiated the administrative shell session cmd.exe (PID 5844) under the hijacked administrator account rsydow-a, concurrently opening Server Manager and the DNS Management MMC snap-in.
Active Directory Users & Groups Enumeration
Attacker executed the Active Directory Users and Computers management console snap-in (dsa.msc, running inside mmc.exe PID 1352) to perform user enumeration, credential scanning, and group privilege evaluation across the domain.
Interactive PowerShell Session PID 6752
The threat actor loaded an interactive powershell.exe session under the rsydow-a profile to prepare execution capabilities. This terminal shell session remained active in memory until triage acquisition.
Interactive command Shell PID 2172
An interactive command shell (cmd.exe) was opened by the attacker inside explorer session PID 5640, reinforcing redundant access on the machine.
Group Policy Modification (mmc.exe gpme.msc - PID 6284)
The attacker achieved Domain Dominance by launching the Group Policy Management Editor (PID 6284) and executing modifications to the Default Domain Policy GPO ({31B2F340-016D-11D2-945F-00C04FB984F9}). This allowed pushing backdoor policies domain-wide.
Forensic Ingress and Memory Capture
Incident Response Analyst cbarton-a established remote ingress and deployed F-Response (PID 6724) to lock down the Domain Controller, capture physical kernel memory via the Mnemosyne.sys driver, and preserve evidence.
| PID | PPID | Process Name | Base Offset | Threads | Wow64 | Create Time (UTC) | Command Line Arguments |
|---|
| Protocol | Local Address | Local Port | Foreign Address | Foreign Port | State | PID | Owner | Created Time |
|---|
Malfind Scan Summary
The Volatility 3 windows.malfind plugin scans Windows memory pages looking for anomalous memory allocations. Specifically, it searches for virtual address descriptor (VAD) leaves marked with `PAGE_EXECUTE_READWRITE` (RWX) protection that are NOT backed by a mapped file on disk (i.e. private memory).
Our memory integrity scan detected RWX allocations strictly within a single process: `Microsoft.ActiveDirectory.WebServices.exe` (PID 2980).
Forensic Assessment: Benign False Positive
Active Directory Web Services (ADWS) is a high-privilege system process written in the .NET framework. .NET utilizing languages rely on a Just-In-Time (JIT) compiler to compile MSIL bytecodes to native CPU instructions dynamically during runtime execution.
To perform JIT compilation, the .NET execution engine allocates private memory pages, writes native code to them, and flags them as executable (RWX). Because these pages are dynamically created in RAM and have no corresponding file path on the local disk, Volatility flags them as suspicious code injections.
Cross-referencing the disassemblies of these regions shows standard .NET CLR compiler header signatures, and no malicious payloads, shells, or socket hooking routines were present in memory. Thus, the system is physically clean from remote memory dll injectors or shellcode implants at the kernel level.
| Registry Hive Memory Offset | Registry File Full Path | Volatility Map State |
|---|
Urgent Active Directory GPO Audit & Rollback
Because the default domain policy GPO was compromised, policies could have propagated malicious directives domain-wide.
- Immediately inspect the physical folder of the Default Domain Policy GPO in the domain
SYSVOLshare:C:\Windows\SYSVOL\domain\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}. - Specifically parse the
GPT.INI, Group Policy Preference XML structures (e.g.ScheduledTasks.xml,Services.xml,Groups.xml) and any startup scripts (.bat, .ps1) for attacker modifications. - Restore the GPO to a known clean backup, or run the command
dcgpofix /target:domainto reset it to default parameters if no secure backup is available.
High-Privilege Identity Remediation
The threat actor gained full domain control through administrative credentials. Active logon states must be immediately invalidated.
- Force a double password reset on the compromised Domain Admin account `rsydow-a` and invalidate any active Kerberos tickets.
- Force a credentials rotation of the compromised lateral service account `wacsvc` across all domain assets.
- Perform a meticulous audit of all groups containing administrative privileges (e.g.,
Domain Admins,Enterprise Admins,Schema Admins,Group Policy Creator Owners) to ensure no backdoor accounts were appended by the attacker.
Host Isolation & Targeted Threat Sweep
Telemetry must be used to neutralize additional components of the threat actor's staging infrastructure.
- Physically isolate the compromised pivot station workstation `172.16.6.18` and any other staging hosts immediately.
- Configure Velociraptor to run an enterprise-wide hunt sweep for staging files identified in the workstation analysis, specifically targeting harvested browser profiles (e.g.,
bhv.cfg, NirSoft scripts) and lateral movement execution components (e.g.px.exe/ PsExec).