AORTA - New Forest Trust with TGT Delegation Enabled (Non-Transitive)

Aaron Shelmire@ashelmire

•updated Jun 29, 2025•1•21

Detects the creation or modification of an Active Directory forest trust with only the CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flag set in TdoAttributes. This indicates the AORTA attack where TGT delegation is enabled without the trust also being marked as transitive. This complements the detection for the 0x808 value.