Kerberos

ASREProasting is the lesser-known sibling of Kerberoasting, but it’s just as dangerous and significantly harder to detect. Unlike Kerberoasting, which requires authenticated access to request service tickets, ASREProasting exploits accounts with Kerberos pre-authentication disabled — allowing attackers to request encrypted AS-REP responses for any user without knowing their password. These encrypted responses can be cracked offline to recover plaintext credentials. This guide builds comprehensive ASREProasting detection in Splunk: the Event 4768 query patterns that identify AS-REQ abuse, accounts vulnerable to ASREProasting, volume anomalies, and the Splunk dashboards that turn authentication logs into actionable threat intelligence. ...

Kerberoasting is the technique every red team uses and every blue team underdetects. An attacker requests Kerberos TGS (Ticket Granting Service) tickets for service accounts, then cracks the encrypted portion offline to recover plaintext passwords. The attack leaves Event 4769 footprints on Domain Controllers that most SOCs ignore — and that’s exactly what makes Kerberoasting so effective in real breaches. This guide builds comprehensive Kerberoasting detection in Splunk: the Event 4769 query patterns that catch RC4 encryption abuse, service account targeting, volume anomalies, and the Splunk dashboards that turn raw Kerberos logs into actionable security intelligence. ...

NTLM has been on borrowed time for two decades, and Microsoft made it official: as of late 2023 Microsoft formally announced that NTLM is deprecated, with Kerberos and the new Negotiate-based authentication taking over. Windows 11 24H2 and Windows Server 2025 ship with NTLMv1 fully removed, and Microsoft strongly recommends auditing and disabling NTLMv2 wherever Kerberos can take over. This guide walks through how to disable NTLM in Windows safely — auditing first, staging the rollout, and rolling back cleanly if something breaks. ...

Kerberoasting remains the highest-ROI Active Directory attack: any authenticated domain user can request a service ticket for any account with a Service Principal Name (SPN), and crack that ticket offline. No special privileges. No exploits. Just Kerberos working as designed. ...