Watching The Watchdog: Protecting Kerberos Authentication With Network Monitoring
summary
Describes concrete detections for four Kerberos forgeries—Skeleton Key, Golden Ticket, MS14-068 fake PAC and a new diamond PAC variant—showing how each alters wire patterns: DC downgrades to RC4, TGTs without parent AS replies, and injected authorization-data fields. Presents a working network-only approach that needs no AD secrets, a released scanner and the free tool Kerberos Leash, and shows detection rules that flag downgrade, missing TGT parents, and abnormal authorization-data sequences; demonstrations run against live malware and simulated attacks.
AI-written summary · about
chapters (14)
- 0:00Watching the Watchdog Protecting Kerberos
- 2:29Why do Attackers Target Kerberos?
- 9:22Kerberos: Stealing
- 11:11The attack campaign • Attackers installed a malware on DC to authenticate as any user by using a secret password
- 14:28AES vs. RC4: Key Derivation
- 15:51Attacker + RC4
- 17:31The Skeleton Key Malware: Kerberos
- 20:05Skeleton Key Malware Detection
- 21:15PAC (Privilege Attribute Certificate)
- 24:06TGT Integrity
- 26:49Let's Play Spot the Difference
- 29:44Golden Ticket in the Wild
- 40:59Diamond PAC exploit
- 45:00Questions?
related talks
51mAbusing Microsoft Kerberos: Sorry You Guys Don't Get It
41mBreaking Kerberos' RC4 Cipher and Spoofing Windows PACs
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
40mTop Active Directory Attacks: Understand, then Prevent and Detect
50mBeyond the Mcse: Active Directory for the Security Professional
46mBack to the Roots of Single Sign-On: Kerberos
29mWhy You Need to Detect More Than PtH
35mWalking Your Dog in Multiple Forests - Breaking AD Trust Boundaries through Kerberos Vulnerabilities