Is it possible to fake being joined to a domain in Windows 10?

Question

I'm dealing with a malware sample from a pentest that will only execute properly if the system is a member of the target organization's Windows Active Directory domain.

Rather than standing up my own AD controller and fake domain every time I want to test with a different domain name, I was hoping to write a PowerShell script to fake information on the local system to look like it was joined to an arbitrary domain.

I tried editing the registry values in HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, but the system still showed as a workgroup system.

Is there any way to make Windows (and therefore Windows malware) think it's a member of a domain, without actually joining a domain?

Answer 1

I'd say no, there are too many changes when a system is joined to an AD domain, and therefore many ways that the malware could verify the existence of the AD domain. A couple off the top of my head:

• running services on the client
• DNS queries
• services reachable on the domain controller
• LDAP queries
• changes to the client registry
• timesync settings

.. you get the idea. I think you would have to spend more time faking the domain membership based on what each piece of malware is looking for, than it would take to run up a DC. If you have a Windows server VM snapshotted, you could just run dcpromo each time, or even better, automate the whole deployment.