Visão Geral

Este curso apresenta o Kerberoasting e sua relação com Service Principal Names (SPNs), contas de serviço e autenticação Kerberos. O participante compreenderá os fundamentos da técnica, os fatores que aumentam a exposição, indicadores de detecção e estratégias de proteção de contas de serviço e ambientes Active Directory.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender o funcionamento do Kerberoasting
• Identificar riscos associados a contas de serviço
• Analisar SPNs e indicadores de abuso
• Detectar solicitações suspeitas de tickets
• Aplicar medidas de hardening

Publico Alvo

• Analistas de Cybersecurity
• Administradores de Active Directory
• Profissionais de SOC e Blue Team
• Threat Hunters
• Pentesters e Red Teamers

Pre-Requisitos

• Conhecimentos de Active Directory
• Familiaridade com Kerberos
• Conhecimentos básicos de PowerShell
• Noções de Service Principal Names
• Familiaridade com Windows Event Logs é recomendada

Conteúdo Programatico

Module 1: Kerberoasting Fundamentals

1. Kerberoasting concepts
2. Kerberos service authentication
3. Service Principal Names
4. Service accounts
5. Service tickets
6. Ticket encryption
7. Credential exposure
8. Attack prerequisites
9. Security implications
10. Kerberoasting attack lifecycle

Module 2: Service Principal Names

1. SPN architecture
2. SPN registration
3. SPN uniqueness
4. Service account association
5. Computer-based SPNs
6. Custom service SPNs
7. SPN enumeration concepts
8. Misconfigured SPNs
9. Privileged service accounts
10. SPN security assessment

Module 3: Service Ticket Security

1. TGS-REQ and TGS-REP
2. Service ticket generation
3. Ticket encryption types
4. Kerberos cryptographic material
5. Service authentication
6. Ticket request patterns
7. Service account password security
8. Weak credential risks
9. Ticket security
10. Service account exposure

Module 4: Kerberoasting Detection

1. Kerberos service ticket monitoring
2. TGS request analysis
3. Unusual service ticket requests
4. Request volume analysis
5. Account behavior analysis
6. Source host analysis
7. Privileged account monitoring
8. Windows Event Logs
9. SIEM correlation
10. Detection engineering

Module 5: Service Account Hardening

1. Strong service account passwords
2. Managed Service Accounts
3. Group Managed Service Accounts
4. Privileged service account protection
5. Least privilege
6. SPN management
7. Account rotation
8. Service account inventory
9. Legacy service assessment
10. Service account security baseline

Module 6: Threat Hunting

1. Kerberoasting hunting methodology
2. Suspicious TGS requests
3. Service account activity
4. Authentication baselining
5. Privileged account behavior
6. Source system analysis
7. Ticket request anomalies
8. Active Directory hunting
9. Attack chain analysis
10. Hunt validation

Module 7: Incident Response

1. Kerberoasting incident identification
2. Suspicious ticket investigation
3. Compromised service account assessment
4. Privilege analysis
5. Lateral movement assessment
6. Credential rotation
7. Service account remediation
8. Persistence investigation
9. Domain security assessment
10. Recovery procedures

Module 8: Practical Kerberoasting Analysis

1. SPN inventory exercise
2. Service account risk assessment
3. Kerberos event analysis
4. TGS request investigation
5. Suspicious authentication scenario
6. Detection rule development
7. Hardening assessment
8. Incident investigation workflow
9. Security control validation
10. Practical Kerberoasting case studies