Visão Geral

Este curso apresenta o conceito de Silver Ticket no contexto do Kerberos e da autenticação de serviços em ambientes Active Directory. O participante compreenderá a relação entre Service Principal Names, contas de serviço e tickets, além de estudar indicadores de abuso, detecção, hardening e resposta a incidentes.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender o conceito de Silver Ticket
• Identificar riscos relacionados a contas de serviço
• Analisar autenticações Kerberos suspeitas
• Detectar comportamentos anômalos
• Aplicar medidas de proteção e resposta

Publico Alvo

• Analistas de Cybersecurity
• Administradores de Active Directory
• Profissionais de SOC e Blue Team
• Incident Responders
• Pentesters e Red Teamers

Pre-Requisitos

• Conhecimentos de Active Directory
• Familiaridade com Kerberos
• Conhecimentos de Service Principal Names
• Noções de contas de serviço
• Familiaridade com Windows Event Logs é recomendada

Conteúdo Programatico

Module 1: Kerberos Service Authentication

1. Kerberos service authentication
2. Service Principal Names
3. Service accounts
4. Service tickets
5. Ticket Granting Tickets
6. Service authentication flow
7. Kerberos keys
8. Session authentication
9. Service trust relationships
10. Service authentication security

Module 2: Silver Ticket Concepts

1. Silver Ticket fundamentals
2. Forged service tickets
3. Service-specific authentication
4. Service account key material
5. Ticket validation
6. Authentication trust boundaries
7. Privileged service accounts
8. Persistence implications
9. Attack indicators
10. Security implications

Module 3: Service Account Security

1. Service account architecture
2. Managed Service Accounts
3. Group Managed Service Accounts
4. Service account passwords
5. SPN management
6. Privileged service accounts
7. Service account permissions
8. Least privilege
9. Service account inventory
10. Service account hardening

Module 4: Silver Ticket Detection

1. Kerberos service ticket monitoring
2. Authentication event analysis
3. Service account activity
4. Ticket anomalies
5. Source host analysis
6. Service access patterns
7. Domain Controller telemetry
8. Event correlation
9. Threat hunting
10. Detection engineering

Module 5: Attack Investigation

1. Silver Ticket incident identification
2. Suspicious service authentication
3. Service account compromise
4. SPN analysis
5. Host and service investigation
6. Privilege assessment
7. Persistence analysis
8. Lateral movement investigation
9. Credential exposure assessment
10. Incident timeline reconstruction

Module 6: Prevention and Hardening

1. Service account protection
2. Managed Service Accounts
3. Strong credential management
4. SPN security
5. Least privilege
6. Administrative tiering
7. Credential isolation
8. Domain Controller hardening
9. Authentication monitoring
10. Service security baseline

Module 7: Incident Response and Remediation

1. Silver Ticket response
2. Compromised service account remediation
3. Credential rotation
4. Service account replacement
5. Host containment
6. Persistence removal
7. Kerberos authentication validation
8. Monitoring improvements
9. Recovery procedures
10. Post-incident assessment

Module 8: Practical Silver Ticket Analysis

1. Service account inventory
2. SPN security assessment
3. Kerberos event investigation
4. Suspicious service authentication scenario
5. Detection rule development
6. Hardening assessment
7. Incident response exercise
8. Security control validation
9. Monitoring improvement
10. Practical Silver Ticket investigation case studies