Visão Geral

Este curso apresenta o protocolo Kerberos e seu papel na autenticação de ambientes Windows e Active Directory. O participante compreenderá a arquitetura do Key Distribution Center, tickets, chaves, processos de autenticação e mecanismos de segurança, além de conhecer riscos associados ao abuso do protocolo e estratégias de detecção e proteção.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender a arquitetura do Kerberos
• Interpretar o fluxo de autenticação
• Diferenciar os principais tipos de tickets
• Identificar riscos de segurança
• Aplicar técnicas de monitoramento e proteção

Publico Alvo

• Administradores de Active Directory
• Analistas de Cybersecurity
• Profissionais de SOC e Blue Team
• Pentesters e Red Teamers
• Incident Responders

Pre-Requisitos

• Conhecimentos de Active Directory
• Familiaridade com Windows Authentication
• Conhecimentos básicos de redes
• Noções de criptografia
• Familiaridade com Windows Event Logs é recomendada

Conteúdo Programatico

Module 1: Kerberos Fundamentals

1. Kerberos authentication concepts
2. Authentication tickets
3. Symmetric cryptography
4. Kerberos principals
5. Authentication sessions
6. Key Distribution Center
7. Kerberos realms
8. Windows Kerberos implementation
9. Kerberos trust model
10. Authentication security principles

Module 2: Key Distribution Center

1. KDC architecture
2. Authentication Service
3. Ticket Granting Service
4. Authentication database
5. Long-term keys
6. Session keys
7. Domain Controller as KDC
8. KDC communication
9. KDC security
10. KDC troubleshooting

Module 3: Kerberos Authentication Flow

1. Initial authentication
2. AS-REQ messages
3. AS-REP messages
4. Ticket Granting Ticket
5. TGS-REQ messages
6. TGS-REP messages
7. Service tickets
8. Application authentication
9. Session establishment
10. Kerberos authentication lifecycle

Module 4: Tickets and Delegation

1. Ticket structure
2. Ticket lifetime
3. Ticket renewal
4. Service Principal Names
5. Service authentication
6. Kerberos delegation
7. Unconstrained delegation
8. Constrained delegation
9. Resource-Based Constrained Delegation
10. Delegation security risks

Module 5: Kerberos Security and Abuse

1. Kerberos attack surface
2. Kerberoasting concepts
3. AS-REP Roasting concepts
4. Pass-the-Ticket concepts
5. Golden Ticket concepts
6. Silver Ticket concepts
7. Ticket theft risks
8. Privileged account abuse
9. Service account risks
10. Kerberos security weaknesses

Module 6: Kerberos Detection

1. Kerberos event logging
2. Authentication event analysis
3. Ticket request monitoring
4. Service ticket analysis
5. Abnormal authentication patterns
6. Encryption type monitoring
7. Account behavior analysis
8. Domain Controller telemetry
9. Threat hunting
10. Detection engineering

Module 7: Kerberos Hardening

1. Privileged account protection
2. Service account security
3. Managed service accounts
4. Password management
5. Delegation restrictions
6. Administrative tiering
7. Domain Controller hardening
8. Authentication policy controls
9. Monitoring and auditing
10. Kerberos security baseline

Module 8: Practical Kerberos Analysis

1. Kerberos authentication investigation
2. Ticket lifecycle analysis
3. Service authentication analysis
4. Suspicious ticket investigation
5. Authentication anomaly detection
6. Delegation security assessment
7. Kerberos event correlation
8. Threat hunting exercise
9. Incident response workflow
10. Practical Kerberos security case studies