OFFENSIVE KERBEROS TECHNIQUES FOR DETECTION ENGINEERING

Summary from the TLDR InfoSec newsletter

As the successor to NTLM, Kerberos is the most widely used authentication mechanism for Active Directory. This article presents an in-depth overview of different attacks like Kerberoasting, unconstrained delegation, constrained delegation, and others against Kerberos and methods for detection and mitigation. Each attack includes necessary background information, a description of the attack and potential impact, and strategies for detecting the attack.