Steal or Forge Kerberos Tickets
Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the ...
BY SOURCE
PROCEDURES (20)
Auto-extracted: 2 detections for script block
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for privilege
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for mimikatz
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for kerbero