Golden Ticket Attacks on Active Directory

Golden Ticket attacks forge Kerberos TGTs using the KRBTGT account hash to gain unrestricted domain access. Explains Kerberos and KRBTGT basics, how Mimikatz is used, and defensive tactics.

Kerberoasting explained: any authenticated user can request service tickets encrypted with weak RC4/DES service-account hashes and crack them offline. Covers Kerberos/SPN basics and defenses.

Semperis researchers, co-authoring with TrustedSec, detail the Diamond Ticket attack—a new Kerberos ticket-forging technique inspired by 2015 Diamond PAC research; covers Rubeus weaponization, OPSEC advantages, and detection guidance.

Kevin Robertson details ten attacker rules for MachineAccountQuota, which lets unprivileged users add up to 10 machine accounts, plus Powermad techniques and the defense of setting MAQ to 0.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

A Golden Ticket attack forges Kerberos TGTs using the KRBTGT hash, granting unrestricted domain access as any user. The post details creation in Cobalt Strike and defenses like tiered administration.