Kerberos: attacks, tickets & AD exploitation

Kerberos is a network authentication protocol used as the default mechanism in Active Directory environments. Kerberos relies on a trusted third party called the Key Distribution Center (KDC), which is hosted by the Domain Controller. The protocol operates through tickets: a client first requests a Ticket Granting Ticket (TGT) from the Authentication Service (AS), then uses that TGT to request service tickets (TGS) for specific resources. Each ticket is encrypted with keys derived from account passwords, which makes Kerberos both strong and a high-value attack surface. Kerberos is pertinent in cybersecurity because compromising the ticketing mechanism grants persistent, credential-independent access to domain resources. Attackers who obtain a valid TGT or forge one using the krbtgt account hash can impersonate any domain user. Understanding how Kerberos tickets are issued, cached, and validated is foundational for both offensive operators and defensive analysts working in Windows enterprise environments.

Blue Team analysts should monitor several Windows Event IDs to detect Kerberos abuse. Event ID 4768 logs TGT requests and reveals AS-REP Roasting attempts when pre-authentication is disabled for an account. Event ID 4769 logs TGS requests and is critical for detecting Kerberoasting: look for RC4 encryption type (0x17) requested against service accounts, especially in high volume. Event ID 4771 indicates Kerberos pre-authentication failures. Event ID 4624 with logon type 3 combined with unusual ticket usage can indicate Pass-the-Ticket activity. On the SIEM side, correlate Mimikatz-related named pipe activity (Event ID 17 and 18 from Sysmon) with subsequent Kerberos requests. Monitor for anomalous TGT lifetimes exceeding domain policy, which may reveal forged Golden Tickets. Tools like Microsoft Defender for Identity (MDI) and Elastic SIEM provide dedicated Kerberos attack detection rules. Baseline service account TGS request rates to spot statistical outliers typical of automated Kerberoasting campaigns.

Red Team operators target Kerberos through several well-documented techniques. Kerberoasting involves requesting TGS tickets for service accounts with SPNs registered in Active Directory, then cracking the RC4-encrypted ticket offline using hashcat or John the Ripper. AS-REP Roasting targets accounts with pre-authentication disabled, allowing ticket retrieval without credentials using tools like Rubeus or Impacket's GetNPUsers.py. Pass-the-Ticket abuses cached TGT or TGS tickets extracted from LSASS memory via Mimikatz (sekurlsa::tickets) or Rubeus (dump), then injecting them into a new session. Golden Ticket attacks require the krbtgt NTLM hash, obtained after DCSync or a full Domain Controller compromise, enabling indefinite forged TGT creation. Silver Tickets forge TGS tickets for specific services without touching the KDC. Mitigations include enforcing AES256 encryption for Kerberos, disabling RC4, enabling pre-authentication on all accounts, rotating the krbtgt account password twice after any compromise, and implementing Protected Users security group policies to restrict credential caching and delegation.