AS-REP Roasting Explained

Password spraying tests a few weak passwords across many accounts, dodging lockouts; Microsoft ties over a third of compromises to it. Covers delayed and Kerberos pre-auth variants plus detection.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

Password guessing attacks exploit default credentials, weak policies, and service accounts. The guide covers attack types, detection, and mitigation, including NIST-aligned guidance.

Group Policy abuse lets attackers with GPO write access push malware as SYSTEM, disable security settings, or plant backdoors. The post covers a SharpGPOAbuse scenario and Purple Knight detection.

Password spraying tries a few common passwords across many accounts to evade lockouts, targeting VPNs, Citrix gateways, and Entra ID tenants. Defenses include MFA and passwordless; DSP can detect it.

Unconstrained delegation lets a service impersonate users across the domain; attackers hunt such servers, capture Kerberos TGTs with Rubeus, and move laterally. Mechanics and remediation covered.