Visão Geral

Este curso apresenta o conceito de Golden Ticket no contexto da autenticação Kerberos e do Active Directory. O participante compreenderá a importância do KRBTGT, os riscos associados à falsificação de tickets, indicadores de comprometimento, estratégias de detecção e procedimentos de proteção e resposta.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender o conceito de Golden Ticket
• Identificar riscos relacionados à conta KRBTGT
• Reconhecer indicadores de tickets anômalos
• Investigar possíveis comprometimentos do domínio
• Aplicar estratégias de resposta e recuperação

Publico Alvo

• Analistas de Cybersecurity
• Administradores de Active Directory
• SOC e Blue Team
• Incident Responders
• Pentesters e Red Teamers

Pre-Requisitos

• Conhecimentos de Active Directory
• Familiaridade com Kerberos
• Conhecimentos de Domain Controllers
• Noções de tickets de autenticação
• Familiaridade com Windows Event Logs é recomendada

Conteúdo Programatico

Module 1: Kerberos and Domain Trust Fundamentals

1. Kerberos authentication architecture
2. Key Distribution Center
3. Ticket Granting Tickets
4. Service tickets
5. Domain authentication
6. Domain trust relationships
7. Kerberos keys
8. Domain Controller role
9. Authentication trust model
10. Kerberos security boundaries

Module 2: KRBTGT Account

1. KRBTGT account fundamentals
2. KRBTGT role in Kerberos
3. Domain encryption keys
4. Ticket signing and validation
5. KRBTGT password lifecycle
6. Domain Controller synchronization
7. KRBTGT security importance
8. Privileged account protection
9. KRBTGT compromise implications
10. KRBTGT security management

Module 3: Golden Ticket Concepts

1. Golden Ticket fundamentals
2. Forged Ticket Granting Tickets
3. Trust abuse concepts
4. Domain privilege implications
5. Ticket lifetime anomalies
6. Authentication bypass concepts
7. Persistence implications
8. Domain-wide impact
9. Attack indicators
10. Security implications

Module 4: Golden Ticket Detection

1. Kerberos event monitoring
2. Ticket lifetime analysis
3. Authentication anomalies
4. Account identity inconsistencies
5. Domain Controller telemetry
6. Source host analysis
7. Privileged authentication monitoring
8. Event correlation
9. Threat hunting
10. Detection engineering

Module 5: Domain Compromise Investigation

1. Golden Ticket incident identification
2. Suspicious Kerberos activity
3. Domain Controller investigation
4. KRBTGT compromise assessment
5. Privileged account analysis
6. Persistence investigation
7. Lateral movement assessment
8. Credential exposure analysis
9. Domain-wide impact assessment
10. Incident timeline reconstruction

Module 6: KRBTGT Protection and Hardening

1. KRBTGT security practices
2. Privileged account protection
3. Domain Controller hardening
4. Administrative tiering
5. Credential isolation
6. Secure administration
7. Active Directory monitoring
8. Authentication auditing
9. Security baseline implementation
10. Domain trust protection

Module 7: Recovery and Remediation

1. Golden Ticket response strategy
2. KRBTGT password rotation concepts
3. Credential invalidation
4. Privileged account remediation
5. Domain Controller validation
6. Persistence removal
7. Authentication validation
8. Security monitoring enhancement
9. Recovery planning
10. Post-incident assessment

Module 8: Practical Golden Ticket Investigation

1. Kerberos event investigation
2. Ticket anomaly analysis
3. Domain compromise scenario
4. KRBTGT risk assessment
5. Detection rule development
6. Incident response exercise
7. Recovery planning exercise
8. Security control validation
9. Monitoring improvement
10. Practical Golden Ticket investigation case studies