Forest

"Forest" is a sophisticated malware that exploits the Golden Ticket, an authentication ticket in Active Directory (AD), to gain unauthorized access across an entire domain or AD forest. Leveraging the Security Identifier (SID) History, the malware uses the Enterprise Admins SID: S-1-5-21 -519, effective when the forged ticket is created in the Forest root domain, to forge admin rights throughout the AD forest. This is achieved by adding the /sids parameter, setting it to be the SID of the Enterprise Admins group in the AD forest ([ADRootDomainSID]-519), effectively spoofing Enterprise Admin rights across every domain in the AD forest. During its operation, Forest performs an exhaustive AD enumeration. It queries all domain objects from the Domain Controller (DC) and enumerates trust relationships within the AD Forest, user accounts, and current session information from every domain computer, including both workstations and servers. This comprehensive approach allows the malware to exploit various vulnerabilities and establish control over the network infrastructure. In response to this threat, we trained a Random Forest classifier to identify patterns indicative of Forest's activities. The classifier was trained using DNS hijacking records collected from various reports, along with benign records from our passive DNS (pDNS) dataset. Despite the computational intensity of both TF–IDF and Random Forest methods, they were highly effective in identifying non-linear data patterns, reducing the risk of overfitting, and providing insights into the importance of various features in the dataset. However, the complexity of the Random Forest model can pose interpretability challenges, especially with larger models.