Trust direction, transitivity, and trust types: Who trusts whom?

1. Core mechanism

This lesson explains trustDirection bits from one-way/two-way relations and transitive/non-transitive types TDO perspective. Cross-domain ticket details remain in 10.06.

Interfaces and specifications

• Trusted Domain Object (TDO): represents trust partner and relationship properties in the directory.
• trustDirection=1 (inbound): the trusted domain trusts the primary domain. Read the direction from the perspective of the domain containing the TDO.
• trustDirection=2 (outbound): the primary domain trusts the trusted domain.
• trustDirection=3: combination of inbound and outbound bits, bidirectional trust.
• Transitive trust: allows trust path to expand in defined domain/forest hierarchy.
• External trust: between certain two domains, non-transitive relationship; forest trust provides transitive coverage between two forest root.

arrow with the question of the resource u

‘A trusts B’ means that resources in A can accept B accounts for authentication. The user flow is correct from B to A source; the user will appear inverted with trust sentence.

trustDirection attribute is a bit area from primary domain perspective with TDO. It carries credential information against TDO on the other side of the same relationship.

Transitivity was not authorized Tags

Transitive trust allows you to create a trust path. This does not mean that every resource on the road is accessed; the target resource decides ACL still.

Parent-child and tree-root trusts are automatic and transitive in the forest. External trust is used to connect the specific two domains non-transitive; forest trust is used for the scope of the ad space between the forests and the supply.

Trust type determines risk model

A realm trust connects AD to a non-AD Kerberos realm. A shortcut trust can shorten the authentication path between two domains in the same forest, avoiding a longer route through the forest root. A shorter path does not grant resource permissions. Direction, transitivity and supported authentication mechanisms must be evaluated for the chosen trust type.

A trust secret does not define an access policy. Lesson 10.06 examines SID filtering, selective authentication and resource ACLs as separate checks along the access path.

State and data flow

1. Client determines the domain/forest location of the target resource.
2. Local domain search for appropriate TDO and trust path.
3. The direction limits whether the authentication request is accepted in this direction.
4. Transitivity determines whether the path will expand and expand directly beyond the partner.
5. Even if the path is found, the target resource provides a separate authorization decision.

2. Exploitation

Broken trust assumption

The attacker trusted has achieved a privilege on a valid basis or trust configuration; trust does not provide unauthorized access to one.

Technical prerequisites

• Trust was established with wider direction/transitivity than required.
• Resource ACLs contain extensive foreign groups or Authenticated Users-like scopes.

Exploitation mechanism

Unnecessed bidirectional or transitive trust enlarges the source area where the attacker can find authentication path. The actual access occurs only if the target allows ACL and subsequent trust controls; so it is the combination of ACL with risk trust.

Wide track coupled with wide path

The presence of the Trust path does not provides the right file to the attacker. However, if there is a broad group or an incorrect foreign SID ACE on the resource side, the authentication path makes this error accessible.

Two-way trust provides operational convenience but compromise blast radius can grow in two ways. If my requirement is one-way, the reverse direction is an additional trust debt.

3. Defense & Detection

Telemetry scope

• Inventory of partner, trustDirection, trustType and trustAttributes values for each TDO.
• Compare trust direction with business data flow; remove unnecessary reverse direction.
• External/forest trust selection is grounded by the requirement of transitivity.
• Correlate resource ACLs containing foreign principals with the trust inventory.

Events and relevant fields

• TrustScript does not prove with a single Event ID; TDO attributes are reviewed together with name suffix routing and two ends configuration.

Verify arrows with two sentences

In each trust diagram, both ‘A trusts B accounts’ writes ‘B users can try authentication to A resources’ phrase. Two tell the same relationship with arrows that appear opposite and reduce direction error.

Then add a separate line of authorization: what is the A resource ACL? Allowing with Trust should not scratch the same line.

Detection logic · Sigma

title: Trusted Domain Object Change Candidate
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5136
  condition: selection

Query assumptions

• 5136 is only a directory-object modification candidate; environment-specific enrichment is needed for TDO class, ObjectDN, and AttributeLDAPDisplayName.
• The event can be generated only when Audit Directory Service Changes Success is enabled on a DC and the changed attribute has a matching Write-audit SACL ACE.
• A change typically produces Value Deleted and Value Added records with the same OpCorrelationID; evaluate AttributeValue together with OperationType.
• This is a generic candidate rule not run on a live system; it does not by itself confirm a trust change or authorized operation.

False positives

• An approved trust-secret rotation or planned TDO configuration change can generate 5136.
• Without the audit policy/SACL, 5136 may not be generated; event absence does not prove that trust posture has not changed.

Hardening

• Establish Trust with the minimum direction and number of destinations required for business flow.
• Non-transitive direct need for external trust; evaluate the forest-wide path if required controlled forest trust.
• The source of Trust Management is connected to the separate but Korean review gate from ACL management.
• Take Bidirectional trust as two separate risk acceptance, not as default convenience.

Read the examples

O:BAG:BAD:(A;;RPWP;;;S-1-5-21-1111111111-2222222222-3333333333-5205)

Two reality checks

Assumption: A automatically goes to B resources if they rely on B.

In fact: The Trust phrase tells you that the resource side is accepted: A can try authentication to the sources of B if he rely on B; the author is still in the A resource ACL.

Assumption: Transitive trust provides automatic access to all resources in the chain.

In fact: Transitivity allows you to expand only authentication path. Separate controls are applied in each target such as SID filtering, authentication limits and source ACL.

Sources

• Microsoft Open Specifications · trustDirection
  TRUST_DIRECTION_DISABLED/INBOUND/OUTBOUND/BIDIRECTIONAL bit values and primary-domain perspective.
• Microsoft Open Specifications · trustAttributes
  TRUST_ATTRIBUTE_NON_TRANSITIVE and TRUST_ATTRIBUTE_FOREST_TRANSITIVE flags; trust relationship attributes.
• Microsoft Open Specifications · trustType
  Normative trustType values and relationship to the trusted domain/TDO.
• Microsoft · Windows Authentication Concepts
  Trust direction and transitivity bound authentication paths; target permissions remain necessary for resource access.
• Microsoft · 5136(S) A directory service object was modified
  Event fields, Security channel/DC generation, Audit Directory Service Changes, matching attribute Write SACL, and operation correlation.
• Microsoft · Planning Forest Root Domain Controller Placement
  Shortcut trusts between domains optimize authentication requests; forest-root DC placement and remote resource access.