Kerberos Ticket encryption

kerb-enc.md

Logging

• Enable Audit Kerberos Service Ticket Operations under Account Logon
• Enabling this audit category on Domain Controllers will result in two interesting event ids being logged

1. 4769: A Kerberos service ticket (TGS) was requested
2. 4770: A Kerberos service ticket was renewed

Kerberos Encryption

"In practical terms, a Windows computer starts a Kerberos conversation sending a list of supported encryption types (ETypes). The KDC responds to the list with the most secure encryption type they both support."

RC4 encryption makes Kerberos vulnerable to Kerberoasting.

get-aduser test.svc -Properties KerberosEncryptionType | select KerberosEncryptionType

KerberosEncryptionType
----------------------
{AES256}

References

• https://adsecurity.org/?p=3458
• https://docs.microsoft.com/en-us/archive/blogs/askds/hunting-down-des-in-order-to-securely-deploy-kerberos
• https://argonsys.com/microsoft-cloud/library/decrypting-the-selection-of-supported-kerberos-encryption-types/
• https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/decrypting-the-selection-of-supported-kerberos-encryption-types/ba-p/1628797