Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A Diamond Ticket in the Ruff

semperis.com | blog | #active-directory | #kerberos | #detection | #rubeus | #diamond-ticket | #ticket-forging

Summary

Semperis researchers, co-authoring with TrustedSec, detail the Diamond Ticket attack—a new Kerberos ticket-forging technique inspired by 2015 Diamond PAC research; covers Rubeus weaponization, OPSEC advantages, and detection guidance.
Published
Collected

original ↗

Related coverage

blog · semperis.com
Unconstrained Delegation Explained
Unconstrained delegation lets a service impersonate users across the domain; attackers hunt such servers, capture Kerberos TGTs with Rubeus, and move laterally. Mechanics and remediation covered.
blog · semperis.com
Golden Ticket Attacks on Active Directory
Explainer on AD Golden Ticket attacks: attackers forge Kerberos tickets to gain access to your organization's IT environment; the post covers basic security hygiene and building layered defenses against them.
blog · semperis.com
How to Redefine Cyber Resilience: Start by Rethinking Hybrid Identity Protection
Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.
blog · semperis.com
AS-REP Roasting Explained
AS-REP Roasting targets accounts with Kerberos pre-authentication disabled: attackers request an encrypted response and crack it offline. The post shows finding and fixing them with Purple Knight.
blog · semperis.com
Password Spraying Detection in Active Directory
Password spraying tests a few weak passwords across many accounts, dodging lockouts; Microsoft ties over a third of compromises to it. Covers delayed and Kerberos pre-auth variants plus detection.
blog · semperis.com
How to Defend Against an Overpass the Hash Attack
Overpass the Hash converts a captured NTLM hash into fresh Kerberos tickets, giving attackers an authenticated session beyond Pass the Hash. Details the Mimikatz technique, detection, and defenses.
back