HOW TO LOSE DOMAIN ADMIN IN 20 MINUTES:HOW A PHYSICAL PENETRATION TEST EXPOSED THE LINK BETWEEN PHYSICAL SECURITY AND CYBERSECURITY

Executive Summary

A recent physical penetration test revealed how physical security and cybersecurity work hand-in-hand. This edition is adapted from a presentation by the NCO Security Team at the Georgia GMIS Spring 2026 Conference, with live demonstrations of how physical security risks can lead to data breaches.

It documents a physical penetration test engagement in which two testers achieved full Domain Administrator privileges within 20 minutes of arriving on-site using only low-cost, commercially available tools and no prior insider access.

The engagement exposed critical weaknesses across physical security, network access control, and endpoint monitoring - with clear recommendations for eliminating them in the future.

Incident Timeline

9:15 a.m.

Testers arrived and parked in the visitor lot, conducting passive observation of employee badge behavior, door prop habits, and physical security camera placement. They didn't interact with any employees at this stage.

Within three minutes, a target entry point - the main lobby - was selected due to its high foot traffic and unmonitored badge reader placement.

9:18 a.m.

A tester entered the lobby posing as a visitor waiting for a meeting. Using a device concealed in a small backpack, he passively captured the RFID signal from an employee's access badge during a brief close-proximity interaction near the reception area.

The clone was written to a blank card in under 60 seconds. No challenge-response authentication or rolling-code protection was in place on the badge system, making the clone immediately functional.

9:22 a.m.

The main entrance employed a secure vestibule - a double-door airlock requiring a valid badge scan to proceed through the inner door. A standard anti-tailgating sensor was present, designed to detect a second person entering before the first has cleared the zone.

The tester defeated this sensor by directing a brief burst from a compressed air canister at the motion detection lens on the inner door frame. The cold gas temporarily disrupted the infrared sensor's reading, creating a blind spot large enough to walk through undetected. The entire bypass took approximately 8 seconds.

9:25 a.m.

The server room door used a standard handle-based lever lock secured by an electronic access control strike. A thin rigid shim tool - roughly the width of a credit card - was inserted into the gap beneath the door and used to depress the internal lever handle from the outside. The door opened in under 90 seconds without triggering any alarm.

9:28 a.m.

Inside the server room, multiple exposed RJ-45 network jacks were found on a patch panel. A $50 commercial network implant device was plugged directly into one of these jacks.

The device was pre-configured to acquire a DHCP address, establish an encrypted reverse tunnel to a tester-controlled command-and-control (C2) server, and passively scan the local subnet.

No 802.1X port-based Network Access Control (NAC) was present. The device received a corporate IP address within seconds and began enumerating the internal network.

9:35 a.m.

With unrestricted Layer 2 access to the corporate network and a flat network topology, the implant device executed a series of automated post-exploitation steps.

Responder was launched, capturing NTLMv2 hashes from workstations on the subnet broadcasting name resolution requests. A captured service account hash was cracked offline (previously performed during setup), yielding plaintext credentials.

The service account had excessive privileges; a pass-the-hash lateral movement to the domain controller was executed via SMB. A new Domain Admin account was created as proof-of-compromise.

9:37 a.m.

Two minutes after the implant device gained a foothold on the network, NCO's EDR generated a Critical-severity behavioral alert. The trigger: an outbound UNC path authentication attempt from an unrecognized device to an external SMB server - a known indicator of credential harvesting or a rogue implant establishing a C2 callback.

NCO's EDR platform identified the threat through converging behavioral signals, none of which required a known malware signature: an unrecognized device initiated outbound SMB (TCP 445) to a non-corporate, external IP address; the UNC path pattern matched behavioral indicators associated with credential relay attacks and rogue implant C2 check-ins in NCO's threat intelligence database; the source device was absent from all endpoint management, MDM, and asset inventory systems; and the connection attempt correlated with a new DHCP lease issued minutes earlier to an unknown MAC address, reinforcing the rogue device classification.

Critically, the EDR system's AI-driven behavioral engine flagged this activity in real time - not during a next-morning log review. The alert was live on the MDR analyst's dashboard within seconds of the network event.

Follow Up

The rogue implant device carried no known malware - no virus, no exploit payload, no file dropped to disk that a traditional antivirus engine would recognize. NCO's EDR platform operates on behavior, not signatures. It asked a different set of questions: Is this device known? Has it ever been seen on this network? Is this traffic pattern consistent with legitimate business operations? The answer to all three was no - and that was enough to trigger a high-confidence alert and set the analyst response in motion. This is precisely the detection model that modern adversaries are designed to evade - and precisely the reason it caught them.

As a result of this test, NCO recommended a number of immediate, short-term, and long-term strategic actions to improve the client's physical security profile, including: disabling or physically blocking all unused patch panel ports in the server room; installing door contact alarms and interior motion sensors on the server room and all IT closets; deploying 802.1X Network Access Control on all switchports, requiring certificate-based or credential authentication before any device receives network access; replacing 125 kHz proximity badges with FIDO2-capable smart cards or mobile credentials with challenge-response authentication; implementing network micro-segmentation to isolate domain controllers from general corporate devices; auditing and remediating service account privilege sprawl to enforce least privilege; replacing lever-style door handles on sensitive areas with deadbolt or magnetic lock mechanisms; upgrading PIR vestibule sensors to dual-technology models (PIR + microwave) to prevent cold-air disruption attacks; and conducting semi-annual physical penetration testing to validate remediation effectiveness.

On the cybersecurity side, NCO's EDR system detected the intrusion and enabled rapid containment - but the MDR team's toolset goes deeper. Customers who deploy NCO's most advanced MDR tools would have seen the attack stopped even earlier, before Domain Admin was ever achieved. The MDR tool deploys deceptive “honey” credentials - honeypot accounts seeded across the environment that are indistinguishable from legitimate service accounts. Any attempt to use them triggers an immediate, high-fidelity alert.

When the rogue implant ran Responder and captured NTLMv2 hashes from the subnet, it would have collected at least one of these decoy credentials. The moment those credentials were used in a pass-the-hash or authentication attempt, NCO's system would have generated a Critical alert with full attacker context - shutting down the lateral movement path to the domain controller before a single privileged action could be taken. The act of harvesting credentials becomes the tripwire: Responder activity detected at the credential-harvesting stage, lateral movement to the domain controller blocked before it began, and Domain Admin rights never granted.

Together, EDR and MDR represent complementary layers of the NCO Security Team's defensive stack: one identifies rogue devices by what they do on the network; the other ensures that what they do on the network triggers a trap. As a result, NCO also recommended expanding EDR and MDR coverage to 100% of endpoints, including servers and privileged workstations, and deploying deception technologies (honeypot credentials, canary tokens) across the internal network to enable faster attacker detection.

Action Items

This engagement demonstrated how a motivated attacker - armed with inexpensive tools and no prior intelligence - can achieve full enterprise domain compromise in under 20 minutes by chaining together physical security gaps and network access control failures. The critical takeaway is that detection works - and speed of detection is everything. The MDR service implemented by NetCyberOps identified the intrusion through behavioral analysis of the implant device's outbound UNC call, catching the attack at the earliest possible moment after network access was established. The newly created Domain Admin account was disabled within six minutes. No data left the network. This outcome underscores the value of active monitoring, behavioral threat detection, and the human expertise provided by a mature MDR program.

Incident Timeline

CURIOUS WHAT IT TAKES TO GET SECURE?