The #1-Cascade

1. The invariant pattern

Microsoft's April 2025 threat-intel report found that adversaries breach a domain controller in more than 78% of human-operated intrusions, and in 35% of cases the DC itself becomes the spreader device. Mandiant's 2025 telemetry puts AD compromise in roughly 9 out of 10 investigated intrusions. Secureworks puts the median time from initial access to ransomware under 24 hours; 10% of cases encrypt within 5.

Against this variance in tooling, ransomware family, and initial vector, the Bow-Tie shape is stable:

The pre-SRE prefix is where clusters genuinely diverge — this is where initial access, foothold, and privilege escalation happen. The post-SRE tail, which is the part most defenders label "the ransomware attack," is nearly identical across families. It is almost entirely #1, with #7 appearing only at the terminal execution event on each victim host.

2. Pre-DA prefix — five forensic variants

The route from outside to DA-in-hand is the variable part. Five patterns dominate the 2025 IR corpus.

Variant A — Valid-credential RDP (Lynx, March 2025)

The DFIR Report's Lynx case is instructive because of what is absent: no brute-force noise, no stuffing failures. A single successful RDP logon to an internet-exposed host with valid credentials acquired elsewhere (stealer, breach corpus, or initial-access broker). Ten minutes later, lateral movement to the DC using a separate compromised domain admin account.

… → ||[prod][@Attacker→@Org]|| #4 →[Δt=10m] #1 →[Δt=15m] #4

Acquisition prefix unresolved (…), use step #4, discovery #1, second DA credential use #4. Per R-CRED, credential application is always #4.

Variant B — VPN foothold → DA escalation (Storm-0300, Akira)

Microsoft observed Storm-0300 gaining initial access through a VPN, then RDP-ing to the DC. The VPN access is #4. The escalation inside is typically a Kerberoasting pass or LSASS access on a Tier-1 host.

Variant C — Server exploit chain (Storm-2603, ToolShell, Aug 2025)

Storm-2603 chained the ToolShell SharePoint vulnerability, dropped a webshell, created admin accounts in AD, and synced them to Entra ID. The initial step is a server-side implementation flaw — #2 per R-ROLE.

#2 →[Δt=mins] #7 (webshell) →[Δt=hours] #1 (create admin) ||[auth][@Org→@Entra]|| →[Δt=mins] #4

Note the #7 step: a webshell is foreign executable content, and its execution is explicit per R-EXEC.

Variant D — Kerberoasting (the purely-#1 DA path)

This is the most elegant path to credentials from a TLCTC perspective. Requesting TGS tickets for service principals is a legitimate Kerberos function — no flaw required. The attacker cracks the encrypted ticket blobs offline, no new cluster needed, then uses the recovered credential.

#1 + [DRE: C (TGS blobs)] →[Δt=offline] #4 →[Δt=mins] #1

Forensic signature: Event ID 4769 with TicketEncryptionType = 0x17 (RC4-HMAC) on unusual service principals, no preceding 4768 anomaly. Per R-CRED, the DRE tag attaches at acquisition (the #1 step), never at the #4 use step.

Variant E — ZeroLogon (CVE-2020-1472)

A flaw in the AES-CFB8 IV handling inside MS-NRPC lets attackers reset the DC machine account password without authentication. An implementation defect in a server-side protocol — classic #2 per R-ROLE. Once the machine account is held, DCSync yields every NTLM hash in the domain.

#2 + [DRE: C (machine acct pwd, then all hashes via DCSync)] →[Δt=s] #4

The cryptographic flaw is the initial generic vulnerability exploited. "Privilege escalation" is the effect, not the cluster (SG4, R-INTRA-9).

3. The post-DA tail — #1-cascade in detail

This is where the structural insight lives. Every step below exploits a designed, advertised capability of Windows, Active Directory, or the backup software. Apply the Precedence-2 test — "would this attack work against a perfect implementation of the same functionality?" — and the answer is yes for every row. That is the definition of #1.

The Storm-2603 Velociraptor-abuse case illustrates the pattern on steroids: attackers modified GPOs to disable Defender's real-time protection, then delivered a fileless PowerShell encryption script. "Fileless" refers to disk persistence, not to classification. The powershell.exe invocation is #1 (LOLBAS host). The attacker's script running inside it is foreign executable content — #7. The execution must be recorded as its own step regardless of whether anything was ever written to disk.

4. Canonical reference path (Lynx-style)

Compressing the full incident into v2.1 notation — evidence-backed steps plus R-EXEC-required #7 markers:

… → ||[prod][@Attacker→@Org]|| #4 →[Δt=10m] #1
    →[Δt=15m] #4 (DA to DC)
    →[Δt=mins] #1 (recon on DC)
    →[Δt=mins] #1 (create "administratr" + 2 lookalikes)
    →[Δt=mins] #1 (add to Domain Admins, GPCO)
    →[Δt=hours] #1 (collect shares, 7-Zip staging)
    →[Δt=mins] #1 → #7 + [DRE: C] (exfil to temp.sh)
    →[Δt=~24h] #1 (RDP to backup server)
    →[Δt=mins] #1 + [DRE: Av] (backup job deletion)
    →[Δt=mins] (#1 → #7)×N + [DRE: Ac] (encryption per host)

TTR for this incident: ~178 hours across nine calendar days. Velocity class VC-3 (hours-to-days). Extortion-speed outliers compress this into VC-2 (minutes-to-hours), but the step sequence is unchanged — only the Δt values shrink.

The gap notation is legitimate here: analysts can describe the structure of what happened without inventing steps they don't have evidence for. … for unknown prefix, ? for a single unresolved step, #1 → … → #1 when log coverage was destroyed by the attacker. Paths are living artifacts.

5. Why the post-DA phase is structurally #1

Domain Admin is, by definition, a role that certifies "these designed functions are yours to use." Every tool the attacker picks up after holding DA — GPMC, vssadmin, net, scheduled tasks, PsExec, WMI, ADMIN$, DCSync replication, backup consoles — is software operating within its advertised functional scope. No implementation flaw is required on any of it.

This is the analytical payoff of Axiom VII: classification by the initial generic vulnerability exploited. The generic vulnerability on every post-DA step is functional scope granted by design to a privileged role. The role is the vulnerability.

Labels like "lateral movement" or "defense evasion" conflate four to six distinct #1 steps, each with its own control surface. That conflation is precisely why "anti-ransomware" as a product category underperforms: it collapses controls against distinct steps into a single undifferentiated blob.

6. Practical notation tips

• Domain Admin seizure is the SRE, not a cluster. The Bow-Tie central event is reached when #4 authenticates as a Tier-0 principal. Mark it explicitly in diagrams — students routinely confuse "DA compromise" with a cluster.
• Do not classify "privilege escalation" as a cluster. Per SG4 and R-INTRA-9, escalation is an effect. When DA is obtained by ZeroLogon, the cluster is #2; the escalation is the effect of that #2. When obtained via Kerberoasting, the path is #1 → #4.
• Backup destruction is dual-DRE territory. Deleting shadow copies is [DRE: Av] on VSS data. Encrypting primary data is [DRE: Ac]. Keep them separate — they have different recovery semantics and drive different controls.
• Anti-forensics is not out of scope. wevtutil cl is #1 + [DRE: Av] on log data. Where post-incident gaps exist, the … notation earns its keep: #9 →[Δt=18h] #4 →[Δt=2m] #1 → … → #1.
• "Fileless" does not mean uncategorized. A PowerShell script carried in memory from a GPO-scheduled task is still foreign executable content. The host process is #1; the attacker's script is #7. Record both.