Visão Geral

Este curso apresenta o funcionamento da autenticação Kerberos e os conceitos associados ao Pass-the-Ticket (PtT). O participante compreenderá tickets de autenticação, riscos relacionados ao roubo e reutilização de tickets, indicadores de comprometimento, técnicas de detecção e mecanismos de proteção do Active Directory.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender a autenticação Kerberos
• Identificar os principais tipos de tickets
• Compreender o Pass-the-Ticket
• Detectar comportamentos anômalos de autenticação
• Aplicar medidas de proteção e resposta

Publico Alvo

• Analistas de Cybersecurity
• Profissionais de SOC e Blue Team
• Administradores de Active Directory
• Incident Responders
• Pentesters e Red Teamers

Pre-Requisitos

• Conhecimentos de Active Directory
• Familiaridade com Kerberos
• Conhecimentos básicos de Windows Authentication
• Noções de Domain Controllers
• Familiaridade com Windows Event Logs é recomendada

Conteúdo Programatico

Module 1: Kerberos Authentication Fundamentals

1. Kerberos architecture
2. Key Distribution Center
3. Authentication Service
4. Ticket Granting Service
5. Ticket Granting Tickets
6. Service tickets
7. Kerberos authentication flow
8. Authentication sessions
9. Ticket lifecycle
10. Kerberos security principles

Module 2: Kerberos Tickets and Credentials

1. Ticket structure
2. Ticket Granting Ticket lifecycle
3. Service ticket lifecycle
4. Ticket encryption concepts
5. Session keys
6. Authentication identifiers
7. Ticket caching
8. User and service authentication
9. Credential material associated with Kerberos
10. Ticket security considerations

Module 3: Pass-the-Ticket Fundamentals

1. Pass-the-Ticket concepts
2. Ticket theft scenarios
3. Ticket reuse
4. Authentication session abuse
5. Privileged ticket risks
6. Ticket-based lateral movement
7. Attack prerequisites
8. Attack indicators
9. Security implications
10. Relationship between credential compromise and ticket compromise

Module 4: Kerberos Abuse and Lateral Movement

1. Kerberos-based lateral movement
2. Remote authentication
3. Service authentication
4. Privileged account abuse
5. Service account risks
6. Domain Controller interactions
7. Authentication anomalies
8. Lateral movement indicators
9. Attack chain analysis
10. Defensive visibility requirements

Module 5: Pass-the-Ticket Detection

1. Kerberos event monitoring
2. Authentication event analysis
3. Ticket request analysis
4. Logon event correlation
5. Source and destination analysis
6. Unusual ticket activity
7. Account behavior analysis
8. Privileged authentication monitoring
9. Detection engineering
10. Threat hunting

Module 6: Advanced Kerberos Threat Detection

1. Golden Ticket concepts
2. Silver Ticket concepts
3. Forged authentication material
4. Abnormal ticket lifetimes
5. Unusual encryption types
6. Service account anomalies
7. Domain privilege abuse
8. Domain Controller indicators
9. Authentication baseline comparison
10. Advanced detection strategies

Module 7: Kerberos Security and Hardening

1. Kerberos security controls
2. Privileged account protection
3. Service account security
4. Managed service accounts
5. Administrative tiering
6. Credential isolation
7. Domain Controller hardening
8. Password rotation
9. Ticket lifetime considerations
10. Identity security architecture

Module 8: Incident Response and Practical Investigation

1. Pass-the-Ticket incident identification
2. Suspicious ticket investigation
3. Compromised account assessment
4. Lateral movement investigation
5. Domain compromise assessment
6. Ticket and credential invalidation
7. Account remediation
8. Domain Controller assessment
9. Recovery procedures
10. Practical Pass-the-Ticket investigation case studies