A ticket that crossed the trust Start this lab

Why this matters

A forest trust is a promise that one domain's claims are honored in another. Authentication material that carries rights the account never held turns that promise into a path.

Concepts

Objectives graded

• Compare the group membership in the ticket with the directory record
• Decide a verdict on the ticket before judging the trust
• Close the crossing path by filtering, keeping the trust in place

MITRE ATT&CK coverage

Authentication material minted in a child domain carrying parent-forest rights nobody granted.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A consequential action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The learner named the group the ticket claimed but the account never held.

  investigation · weight 20 · T1134.005 Access Token Manipulation: SID-History Injection (Privilege Escalation)

• The ticket was judged rather than the whole trust being condemned.

  investigation · weight 15 · T1550 Use Alternate Authentication Material (Defense Evasion)

• The crossing path was closed by filtering, with the trust left standing.

  behavior · weight 20 · T1078 Valid Accounts (Defense Evasion)

Common mistakes

• Condemning the trust on the evidence of a single ticket.
• Resetting the user's password while the forged material remains valid for its lifetime.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.