How to Defend Against Golden Ticket Attacks: AD Security 101

Explainer on AD Golden Ticket attacks: attackers forge Kerberos tickets to gain access to your organization's IT environment; the post covers basic security hygiene and building layered defenses against them.

A Golden Ticket attack forges Kerberos TGTs using the KRBTGT hash, granting unrestricted domain access as any user. The post details creation in Cobalt Strike and defenses like tiered administration.

Overpass the Hash converts a captured NTLM hash into fresh Kerberos tickets, giving attackers an authenticated session beyond Pass the Hash. Details the Mimikatz technique, detection, and defenses.

Pass the Ticket attacks abuse Kerberos: attackers extract TGTs and service tickets from memory using Rubeus, then reuse them to impersonate users and move laterally, enabling ransomware or APTs.

Kerberoasting explained: any authenticated user can request service tickets encrypted with weak RC4/DES service-account hashes and crack them offline. Covers Kerberos/SPN basics and defenses.

Kevin Robertson details ten attacker rules for MachineAccountQuota, which lets unprivileged users add up to 10 machine accounts, plus Powermad techniques and the defense of setting MAQ to 0.