Kerberos
The Active Directory ticket system.
Category: Active Directory · Kerberos & NTLM 🎯 Trench — The Active Directory ticket system. If you steal the master ticket (Golden Ticket), you have full control of the company’s network and you keep access even if the admin rotates all passwords. 🔗 Kill chain — Prerequisite: low-level access to a domain machine. Next moves: AS-REP Roasting → Kerberoasting → Silver/Golden Ticket → DCSync. 📡 Defensive footprint — Event ID 4768 (TGT issued), 4769 (TGS issued). A Golden Ticket triggers a 4769 with RC4 encryption when the domain expects AES — instant red flag for SOC L2. ⚠️ False friend — Thinking only the DC sees these events. Any modern EDR (Defender for Identity, Falcon) correlates them in real time. 🛡️ Remediation — Force AES at KDC, rotatekrbtgt every 180
days, audit SPNs of service accounts without gMSA.
← Back to the full glossary Last updated: 2026-06-11