This investigation reconstructed a full Active Directory compromise chain — from an initial foothold through credential dumping, Pass-the-Hash lateral movement, and Domain Admin privilege escalation — using memory forensics and multi-source log corroboration rather than a single alert. It was completed as the final challenge of Red Team Leaders × 0xDelta Research's 5-Week Certification Challenge and earned the Week 5 Technical Precision Award, along with a 100% voucher toward the CRDFA (Certified RTL Digital Forensic Analyst) credential.
- The attacker used a "ghost session" technique — an orphaned LSASS handle left behind after a legitimate admin logoff — to dump credentials without triggering a fresh authentication event
- Extracted NTLM hashes were used directly for Pass-the-Hash authentication, never cracked — meaning password complexity policy offered zero protection
- Lateral movement from workstation to Domain Controller took under six minutes from initial hash extraction
- Multi-source corroboration (memory dump + Windows Security logs + network authentication logs) was required to build a defensible timeline — no single source told the full story
The Problem
The challenge scenario presented a compromised workstation with signs of credential access activity, but no immediately obvious point of entry. The task: reconstruct the complete attack chain from initial compromise to the attacker's final privilege level, using memory forensics as the primary evidence source — the kind of investigation that separates "I can run tools" from "I can build a defensible timeline a court or CISO could rely on."
The Approach
I treated this as a formal DFIR engagement rather than a CTF exercise — documentation and defensibility mattered as much as finding the answer:
- Memory acquisition & triage — captured and parsed the provided memory image with Volatility, focusing first on process listings and LSASS handle history
- Credential access reconstruction — identified the ghost LSASS session: a stale process handle from a prior legitimate admin session that the attacker reused to dump credentials without generating a new logon event
- Hash extraction confirmation — recovered NTLM hashes from the memory dump matching the
sekurlsa::logonpasswordsoutput pattern - Lateral movement mapping — cross-referenced Windows Security Event ID 4624 (Logon Type 3 / NTLM) across multiple hosts to trace the Pass-the-Hash authentication chain from the initial workstation to the Domain Controller
- Corroboration — validated every memory-forensics finding against an independent log source before including it in the final timeline
Most Pass-the-Hash detections look for a fresh, suspicious authentication event. This attacker avoided that entirely by riding an already-open session handle — the kind of technique that evades naive detection logic and requires memory-level analysis to catch.
Technical Analysis
Pass-the-Hash attack flow — the five-stage chain from initial compromise to lateral movement
Stage 2 Ghost LSASS session identified — stale admin handle reused
Stage 3 sekurlsa::logonpasswords — NTLM hashes dumped from memory
Stage 4 Pass-the-Hash — hash used directly, no cracking required
Stage 5 Lateral movement — workstation → file server → Domain Controller
Detection Event ID 4624 (Logon Type 3, NTLM) correlated across 3 hosts
Confirmed Domain Admin access achieved in under 6 minutes from hash extraction
Challenges
No single source told the full story. The memory dump proved credential access but not lateral movement. The event logs proved lateral movement but not how the credentials were obtained. Only combining both sources — and being disciplined about not overstating what either alone could prove — produced a timeline that would hold up to scrutiny.
Distinguishing legitimate admin activity from attacker reuse. Because the attacker rode an existing session rather than creating a new one, the hardest part was proving that a specific, otherwise-unremarkable LSASS handle was the actual access point — not just asserting it.
Results
- Full attack chain reconstructed and documented to a formal DFIR reporting standard — timeline, evidence, and MITRE ATT&CK mapping
- Awarded the Week 5 Technical Precision Award by Red Team Leaders × 0xDelta Research out of the full 5-Week Certification Challenge cohort
- Earned a 100% voucher toward CRDFA (Certified RTL Digital Forensic Analyst) — currently in progress
Lessons Learned
Detection logic that only watches for new, anomalous authentication events misses attackers who reuse existing sessions. This case reinforced that credential-access detection needs to include memory-level visibility, not just log-based correlation — and that a defensible DFIR timeline requires proving each link in the chain independently rather than assuming the story once one piece is found.
What I'd Improve
- Build a repeatable Volatility triage checklist specifically for ghost-session detection, since this pattern is easy to miss on a first pass
- Add automated LSASS access alerting (e.g., via Sysmon Event ID 10) to catch this technique before an attacker reaches Pass-the-Hash stage
- Formalize the multi-source corroboration process into a standard DFIR checklist template for future investigations
References
- MITRE ATT&CK — T1003.001 LSASS Memory
- MITRE ATT&CK — T1550.002 Pass the Hash
- Red Team Leaders × 0xDelta Research — 5-Week Certification Challenge, Week 5