How to Defend Against a Pass the Ticket Attack: AD Security 101

Overpass the Hash converts a captured NTLM hash into fresh Kerberos tickets, giving attackers an authenticated session beyond Pass the Hash. Details the Mimikatz technique, detection, and defenses.

Golden Ticket attacks forge Kerberos TGTs using the KRBTGT account hash to gain unrestricted domain access. Explains Kerberos and KRBTGT basics, how Mimikatz is used, and defensive tactics.

Kerberoasting explained: any authenticated user can request service tickets encrypted with weak RC4/DES service-account hashes and crack them offline. Covers Kerberos/SPN basics and defenses.

Explainer on AD Golden Ticket attacks: attackers forge Kerberos tickets to gain access to your organization's IT environment; the post covers basic security hygiene and building layered defenses against them.

SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.

Kevin Robertson details ten attacker rules for MachineAccountQuota, which lets unprivileged users add up to 10 machine accounts, plus Powermad techniques and the defense of setting MAQ to 0.