Read-Only Directory Graph Verification for Kerberos Delegation, Authentication Relay, and Access-List Escalation
Inside a corporate network, an attacker requests an old RC4 service ticket to crack offline, relays an unencrypted authentication handshake to a domain controller, or abuses a misconfigured permission edge to become a domain administrator. The verifier audits directory access-control graphs in read-only mode without locking a single account.
Internal enterprise networks rely on directory services and ticket-granting protocols to authenticate users and workstations. Lateral movement and domain dominance pathways arise when service accounts support legacy weak encryption ciphers, when directory and certificate services accept unsigned or unbound authentication relays, or when transitive access-control list (ACL) permissions grant low-privilege principals write rights over privileged group objects.
Security Officer (Plain Meaning): Halts "Extract domain password hashes (DCSync), relay NTLM authentication, or lock out domain user accounts" before socket (0 live DB damage, signed GOST receipt)
IT Auditor & SecOps (Evidence): Scope MITRE ATT&CK T1558.003 / T1557.001 | Wire Rule SEC-ZD-V2-08 | Formal Witness 3b89d042f7168e35
Technocrat, CTO & VC (Moat): Z3 Invariant (assert (and (= (ldap_signing_channel_binding dc) REQUIRED... | FP = 0.0% | Contract IMMUNE-ADK-3B89D042 (mcp-sentinel 1.1.2)1. In-Path Interception and Contract Synthesis Schematic for INF-ADK-08
Deterministic verification flow for INF-ADK-08 (MITRE ATT&CK T1558.003 / T1557.001, CWE-287 / MS-KILE / MS-NRPC): wire filter SEC-ZD-V2-08 intercepts destructive mutations prior to socket delivery, formal witness 3b89d042f7168e35 proves the flaw, and compiler emits gateway rule IMMUNE-ADK-3B89D042 for mcp-sentinel.
2. Zero-Damage Wire Filtering and Formal Solver Invariant for INF-ADK-08
Under rule SEC-ZD-V2-08, the in-path software filter restricts directory verification strictly to read-only metadata queries and static access-control graph analysis. Password-spraying probes that could trigger account lockouts, credential replication commands, and live ticket-relay exploits are blocked before reaching the socket.
On the benchmark stand, the verifier evaluates encryption-type flags, channel-binding headers, and privilege-escalation paths across vulnerable and hardened directory fixtures. The differential check produces formal witness 3b89d042f7168e35 with zero false positives.
Class Identifier: INF-ADK-08 (active_directory_kerberos)
Taxonomy Concordance: MITRE ATT&CK T1558.003 / T1557.001 | CWE-287 / MS-KILE / MS-NRPC
Execution Mode: Active Safe Probing (AUTO_SCAN)
Candidate Probe: LDAP Search (RootDSE / SPN audit): (&(servicePrincipalName=*)(msDS-SupportedEncryptionTypes:1.2.840.113556.1.4.803:=4))
Blocked Mutation: Extract domain password hashes (DCSync), relay NTLM authentication, or lock out domain user accounts
Z3 Solver Invariant: (assert (and (= (ldap_signing_channel_binding dc) REQUIRED) (= (rc4_spn_ticket kdc) false) (= (unconstrained_delegation host) false)))
Wire Sandbox Rule: SEC-ZD-V2-08
Formal Witness Hash: 3b89d042f7168e35
Compiled Sentinel Rule: IMMUNE-ADK-3B89D042 (mcp-sentinel 1.1.2)3. Autonomous Synthesis of Gateway Contract IMMUNE-ADK-3B89D042 and Streebog-256 Receipt
From witness 3b89d042f7168e35, the compiler emits contract IMMUNE-ADK-3B89D042 for border enforcement. The policy disables weak ticket ciphers, mandates directory signing and channel binding (EPA), and removes unconstrained delegation and dangerous ACL edges.
4. Engineering Reference Notes for INF-ADK-08
Verifying Kerberoasting and delegation risks without cracking passwords or locking users
The verifier inspects encryption-support bitmasks, delegation flags, and principal metadata directly from read-only directory attributes, proving susceptibility without brute-forcing a single password.
Stopping NTLM relay attacks against directory and certificate authorities
The compiled remediation contract enforces mandatory LDAP signing, channel binding tokens over TLS, and extended protection for authentication across all domain endpoints.