Incident Response Recovery: Do I need to build a new domain after an incident (like ransomware)?
In the ideal world, yes. You would build a new domain and new domain controllers. You would rebuild all of your servers and workstations and use nothing from before the incident.
In reality: That's not affordable, and it's not fast.
The business needs to get up and running. Your job is to get the business up and running so we can make money and serve its customers in the safest way possible.
Once you have established containment and have the environment monitored and protected with EDR...
My process:
1) Fix Active Directory if broken/corrupted. Fix replication. Fix trusts.
2) Perform a user audit and nuke any accounts from old service providers, old vendors, and ex-employees. Any accounts that you have identified as compromised accounts used by the attacker in the attack should also be disabled/deleted.
3) Perform password resets for all users and service accounts. Enable MFA and enforce MFA on all accounts. MFA should be required for access to email, remote access to any system, and access to critical data and control infrastructure.
4) Reset your Kerberos golden ticket twice. This prevents the Kerberos tickets from being used for pass-the-hash. I space these resets out so that the domain has a chance to propagate the reset.
5) Implement AD hardening (Disable SMBv1, require signing, etc.... I recommend the CIS hardening). Implement any architectural changes (AD red forest).
6) Build new DCs to replace old DCs and transfer roles (if able, based on the incident and time constraints).
There are a lot of other cleanup steps that I'm assuming you've already done... checking task scheduler... looking for IOCs...checking group policy for distribution of persistence mechanisms or malware.
This post is really just to answer the question: Do I need to build new domain controllers (DCs) after a cybersecurity incident like ransomware?