AD attacks are well-documented, predictable, and devastatingly effective. The good news is that defenders have tools to detect them.

Kerberoasting is one of the most common AD attacks. Service accounts in Active Directory have Service Principal Names (SPNs). When you request a Kerberos ticket for a service, the KDC issues you a ticket encrypted with the service account’s password hash. You can then take that ticket offline and crack the hash.

Part of the free Intro to Cyber course by Cover6 Solutions.