AORTA - New Forest Trust with TGT Delegation Enabled
Detects the creation of a new Active Directory forest trust with both FOREST_TRANSITIVE (0x00000008) and CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION (0x00000800) flags set, indicative of the AORTA attack. This rule specifically checks for the TdoAttributes value 0x808, which represents the exact combination of these two flags. Attackers might set additional flags, which would result in a different TdoAttributes value, potentially leading to false negatives. Consider implementing backend-specific bitwise checks if your SIEM supports them for more comprehensive detection.
Sigma
