Hardening Active Directory: Blue Team Kerberos Diamond Ticket Defense

Md. Redwan Ahmed Md. Redwan Ahmed
·
Hardening Active Directory: Blue Team Kerberos Diamond Ticket Defense

Overview & Defensive Context: The Fallacy of KDC-Issued Ticket Implicit Trust#

Harden Active Directory against Kerberos Diamond Tickets: rotate krbtgt twice, enforce PAC signature validation, and audit Event ID 4769.

In our morning threat architecture analysis, we deconstructed the offensive mechanics of Kerberos Diamond Tickets (mapped to MITRE ATT&CK T1558.001: Steal or Forge Kerberos Tickets: Golden and Diamond Ticket, T1078: Valid Accounts, and T1098: Account Manipulation). We demonstrated how an adversary possessing the domain krbtgt AES-256 encryption key circumvents traditional Golden Ticket detection heuristics. Rather than forging an entirely fictitious Ticket Granting Ticket (TGT) from scratch, the attacker initiates a legitimate Kerberos Authentication Service Exchange (AS-REQ / AS-REP) via a compromised low-privilege identity. The adversary then decrypts the genuine KDC-issued TGT using the extracted krbtgt key, injects elevated security identifiers (SIDs)—such as Domain Admins (RID 512) or Enterprise Admins (RID 519)—into the KERB_VALIDATION_INFO structure within the Privilege Attribute Certificate (PAC), recalculates the PAC_SERVER_CHECKSUM and PAC_PRIVSVR_CHECKSUM, re-encrypts the ticket, and presents it to the Key Distribution Center (KDC) during subsequent Ticket Granting Service exchanges (TGS-REQ).

For enterprise blue teams, identity security architects, and incident responders, defending Active Directory against Diamond Tickets exposes deep structural blind spots in legacy identity monitoring:

  • The Invalidation of Timestamp and Lifetime Heuristics: Traditional detection rules for Golden Tickets rely heavily on identifying abnormal ticket lifetimes (such as 10-year expiration windows) or timestamps generated outside normal KDC skew tolerances. Because a Diamond Ticket begins as an authentic KDC-issued ticket, its authtime, starttime, endtime, and renew_till fields precisely match the domain Kerberos policy (typically 10 hours max lifetime with a 7-day renewal window). Heuristic SIEM rules scanning for anomalous ticket durations fail completely.
  • The Presence of Genuine KDC Issuance Telemetry: Golden Tickets leave no trace of an initial AS-REQ authentication exchange because the attacker synthesizes the TGT offline. In stark contrast, Diamond Ticket generation produces a fully legitimate Windows Security Log Event ID 4768 (A Kerberos authentication ticket (TGT) was requested) on the Domain Controller. Security analysts investigating anomalous access observe authentic authentication telemetry, attributing the logon to legitimate client traffic.
  • Cryptographic Suite and Key Version Number Fidelity: Offline ticket synthesis often introduces structural discrepancies in the Key Version Number (kvno), encryption algorithms, or ticket realm casing. With Diamond Tickets, the adversary extracts the active krbtgt AES-256 key matching the current production kvno, preserving the exact cryptographic suite (AES256-CTS-HMAC-SHA1-96) and directory metadata expected by the KDC.
  • Internal PAC Structure Tampering Without Directory Mutation: Inside the PAC binary buffer, the KERB_VALIDATION_INFO structure houses the user's primary RID, group SID array (GroupIds), and extra SIDs (ExtraSids). Because the adversary modifies these fields directly in memory within the encrypted ticket rather than altering Active Directory database objects via LDAP, no directory object change logs (such as Event ID 4728: A member was added to a security-enabled global group) are generated on the Domain Controller. The directory database continues to show the account as an ordinary unprivileged domain user.
  • The Limitations of Host-Centric EDR Sensors on Adversary Runtimes: Modern Endpoint Detection and Response (EDR) platforms maintain behavioral hooks into the Local Security Authority Subsystem Service (lsass.exe) to intercept credential injection, memory dumping, and token manipulation. However, in a Diamond Ticket attack lifecycle, the decryption of the authentic TGT, the injection of modified group SIDs into the KERB_VALIDATION_INFO PAC buffer, and the cryptographic recalculation of PAC_SERVER_CHECKSUM occur entirely in user-space memory on an unmanaged, adversary-controlled machine. Domain Controllers receive a perfectly structured Kerberos packet over port 88 without any endpoint telemetry registering on internal domain hosts.
  • The Imperative for Cryptographic PAC Verification and Key Invalidation: Neutralizing Diamond Tickets requires a fundamental shift from boundary perimeter monitoring to continuous cryptographic verification and identity isolation. Defensive posture demands an automated dual krbtgt password rotation runbook, full enforcement of Microsoft PAC signature validation (PacSignatureValidationLevel = 3 per KB5020805 / CVE-2022-37967), placement of all administrative identities into the Protected Users security group, and rigorous SIEM correlation between ticket requests (Event ID 4769) and directory-defined privilege baselines.
Warning

A single rotation of the krbtgt account password does NOT invalidate active Diamond Tickets or Golden Tickets. Active Directory preserves the previous krbtgt password in history (msDS-KrbTgtLinkBl) to allow existing legitimate tickets to decrypt. Blue teams must execute a two-cycle rotation separated by a 24-hour replication window to completely purge compromised keys.

⚔️ Exploitation Mechanics: For root-cause memory corruption analysis and attack flow, see our deep-dive: Deconstructing Breakdown.

Architecture Hardening: Five-Tier Defense-in-Depth for Kerberos Identity#

Establishing comprehensive defense against Diamond Ticket attacks requires deploying overlapping technical controls across Active Directory domain infrastructure: key lifecycle revocation, cryptographic PAC enforcement, privileged identity containment, encryption protocol hardening, and telemetry correlation.

Defense Architecture Flowchart#

flowchart TD
    classDef client fill:#1e293b,stroke:#ef4444,stroke-width:2px,color:#f8fafc
    classDef gate fill:#0f172a,stroke:#3b82f6,stroke-width:2px,color:#93c5fd
    classDef secure fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#6ee7b7
    classDef audit fill:#4c1d95,stroke:#8b5cf6,stroke-width:2px,color:#ddd6fe
    classDef drop fill:#450a0a,stroke:#dc2626,stroke-width:2px,color:#fca5a5
    classDef pass fill:#065f46,stroke:#34d399,stroke-width:2px,color:#a7f3d0

    Attacker[Adversary Injects Modified PAC into KDC-Issued TGT]:::client --> Tier1Check{Tier 1: krbtgt Key Version Check}:::gate

    Tier1Check -- Ticket Key Matches Current or Historic krbtgt --> Tier2Check{Tier 2: PAC Signature Validation Level}:::gate
    Tier1Check -- Ticket Key Signed by Revoked krbtgt Key --> KeyReject[Action: KDC Rejects Ticket with KRB_AP_ERR_MODIFIED]:::drop

    Tier2Check -- PacSignatureValidationLevel 3: Enforcement Mode --> PACAudit{KDC Cryptographic PAC Verification}:::gate
    Tier2Check -- Registry Unenforced: Legacy Mode 0 or 1 --> LegacyAccept[Vulnerable: KDC Accepts Modified PAC Without Requestor Check]:::drop

    PACAudit -- PAC_REQUESTOR Mismatch or Invalid Server Checksum --> DropPAC[Action: KDC Rejects TGS-REQ with KDC_ERR_MODIFIED]:::drop
    PACAudit -- Full Signature and Requestor SID Validated --> Tier3Check{Tier 3: Identity Isolation Policy}:::gate

    DropPAC --> LogAudit[Log System Event 37 and 38 PAC Verification Failure]:::audit

    Tier3Check -- User in Protected Users: Delegation Denied --> Tier4Check{Tier 4: Encryption Suite Policy}:::gate
    Tier3Check -- Standard Account: Unconstrained Delegation Enabled --> RiskExpose[High Risk: Ticket Susceptible to Forwarding Abuse]:::drop

    Tier4Check -- AES-256 Enforced: RC4-HMAC Disabled Globally --> Tier5SIEM{Tier 5: Event Telemetry Correlation}:::pass
    Tier4Check -- Legacy RC4 Allowed: Weak Cryptographic Salts --> WeakCrypto[Warning: Weak Hash Extraction Susceptible to Roasting]:::drop

    Tier5SIEM --> SIEMRule[Correlate Event 4768 and 4769 with Active Directory Group Baseline]:::audit
    SIEMRule --> ValidAdmin[Account Legitimate Domain Admin: Authorize Access]:::secure
    SIEMRule --> MismatchAlert[Alert: Account Requests Privileged Service Ticket Without AD Group Membership]:::drop

Tier 1: Automated Dual KRBTGT Password Rotation Runbook#

The krbtgt account functions as the root service principal for all Kerberos ticketing within an Active Directory domain. Because Active Directory retains the previous krbtgt password in the msDS-KrbTgtLinkBl attribute to prevent widespread enterprise outages during routine password updates, an attacker who obtains the domain krbtgt hash can continue forging tickets until the password has been rotated twice.

Key Invalidation Mechanics and Replication Timing

  1. Cycle 1 (Initial Revocation): Resetting the krbtgt password updates the current key to kvno = N + 1 while moving the compromised key into the previous key slot (kvno = N). Newly requested TGTs are encrypted with the new key. Existing legitimate client tickets remain valid and can still decrypt.
  2. Replication and Quorum Window: The forest must replicate the updated krbtgt secret across all Domain Controllers (DCs) before proceeding. Furthermore, the environment must wait for the maximum Kerberos ticket lifetime to elapse (by default, 10 hours for ticket lifetime and up to 24 hours to accommodate clock skew and active ticket renewals) to allow legitimate clients to refresh their sessions naturally. If an administrator executes both rotations back-to-back without this waiting period, every active client session across the enterprise immediately drops, triggering severe operational disruption.
  3. Cycle 2 (Purge of Compromised Key): Executing the second rotation advances the current key to kvno = N + 2 and pushes kvno = N + 1 into the previous slot. This completely overwrites and purges the compromised key (kvno = N) from the directory. Any Golden Ticket or Diamond Ticket created with the compromised key is immediately rendered un-decryptable, returning KRB_AP_ERR_MODIFIED (0x29) or KDC_ERR_ETYPE_NOSUPP (0xE).

Production PowerShell Script: KRBTGT Double-Rotation Orchestrator

The following production-ready PowerShell runbook validates forest-wide DC replication health, performs safe simulation, and executes the dual-rotation sequence with structured error handling:

POWERSHELL 
<#
.SYNOPSIS
    Rotate-KRBTGT-Production.ps1
    Orchestrates safe, automated dual krbtgt password rotation across Active Directory.
.DESCRIPTION
    Validates DC replication topology, metadata version numbers (kvno), and enforces
    staged key invalidation to neutralize Diamond and Golden Tickets.
#>
[CmdletBinding(SupportsShouldProcess = $true)]
param(
    [Parameter(Mandatory = $false)]
    [ValidateSet("Audit", "Cycle1", "Cycle2")]
    [string]$ExecutionPhase = "Audit",

    [Parameter(Mandatory = $false)]
    [string]$DomainController = $env:LOGONSERVER.TrimStart('\')
)

Import-Module ActiveDirectory -ErrorAction Stop

function Test-ADReplicationHealth {
    [CmdletBinding()]
    param([string]$TargetDC)
    
    Write-Host "[*] Auditing Forest Replication Topology via $TargetDC..." -ForegroundColor Cyan
    $ReplicationPartners = Get-ADReplicationPartnerMetadata -Target $TargetDC -Scope Server
    $FailedPartners = $ReplicationPartners | Where-Object { $_.ConsecutiveFailureCount -gt 0 }
    
    if ($FailedPartners) {
        Write-Error "[!] Replication failures detected across $($FailedPartners.Count) DC partners. Aborting rotation."
        $FailedPartners | Format-Table Partner, ConsecutiveFailureCount, LastReplicationResult -AutoSize
        return $false
    }
    
    Write-Host "[+] All Active Directory replication partners reporting zero consecutive failures." -ForegroundColor Green
    return $true
}

function Get-KrbTgtMetadata {
    [CmdletBinding()]
    param([string]$TargetDC)
    
    $User = Get-ADUser -Identity "krbtgt" -Server $TargetDC -Properties msDS-KeyVersionNumber, PasswordLastSet, whenChanged
    [PSCustomObject]@{
        DomainController   = $TargetDC
        CurrentKVNO        = $User."msDS-KeyVersionNumber"
        PasswordLastSet    = $User.PasswordLastSet
        LastModifiedTime   = $User.whenChanged
    }
}

# --- Execution Entry Point ---
Write-Host "==================================================================" -ForegroundColor Yellow
Write-Host " ACTIVE DIRECTORY KRBTGT KEY LIFECYCLE MANAGEMENT RUNBOOK " -ForegroundColor Yellow
Write-Host "==================================================================" -ForegroundColor Yellow

$HealthCheck = Test-ADReplicationHealth -TargetDC $DomainController
if (-not $HealthCheck) {
    Exit 1
}

$CurrentMeta = Get-KrbTgtMetadata -TargetDC $DomainController
Write-Host "[i] Current KRBTGT State on $DomainController:" -ForegroundColor Gray
$CurrentMeta | Format-List

switch ($ExecutionPhase) {
    "Audit" {
        Write-Host "[+] Audit complete. No state changes executed." -ForegroundColor Green
        Write-Host "[i] To execute first rotation: .\Rotate-KRBTGT-Production.ps1 -ExecutionPhase Cycle1" -ForegroundColor Yellow
    }
    
    "Cycle1" {
        Write-Host "[!] INITIATING CYCLE 1 ROTATION: Revoking active key, promoting historic key..." -ForegroundColor Yellow
        $Confirmation = Read-Host "Are you sure you want to rotate krbtgt (Cycle 1)? (YES/NO)"
        if ($Confirmation -eq "YES") {
            # Generate cryptographically secure random password (128 characters)
            $Assembly = Add-Type -AssemblyName System.Web
            $SecurePassword = [System.Web.Security.Membership]::GeneratePassword(128, 32)
            $SecureString = ConvertTo-SecureString $SecurePassword -AsPlainText -Force
            
            Set-ADAccountPassword -Identity "krbtgt" -NewPassword $SecureString -Reset -Server $DomainController
            Write-Host "[+] Cycle 1 password update successful." -ForegroundColor Green
            
            # Trigger immediate forest sync
            Write-Host "[*] Triggering forest-wide urgent directory replication..." -ForegroundColor Cyan
            Sync-ADObject -Object (Get-ADUser -Identity "krbtgt").DistinguishedName -Mode HighPriority
            
            Write-Host "[!] MANDATORY ACTION: Wait a minimum of 24 hours for Kerberos ticket refresh before Cycle 2." -ForegroundColor Red
        }
    }
    
    "Cycle2" {
        Write-Host "[!] INITIATING CYCLE 2 ROTATION: Purging compromised key from AD history..." -ForegroundColor Red
        $TimeSinceLastSet = (Get-Date) - $CurrentMeta.PasswordLastSet
        if ($TimeSinceLastSet.TotalHours -lt 10) {
            Write-Warning "[!] WARNING: Less than 10 hours have passed since last rotation ($([math]::Round($TimeSinceLastSet.TotalHours, 2)) hours)."
            $ForceProceed = Read-Host "Proceeding now will force-disconnect active sessions. Proceed? (OVERRIDE/CANCEL)"
            if ($ForceProceed -ne "OVERRIDE") {
                Write-Host "[-] Cycle 2 aborted by operator." -ForegroundColor Cyan
                Exit 0
            }
        }
        
        $Assembly = Add-Type -AssemblyName System.Web
        $SecurePassword = [System.Web.Security.Membership]::GeneratePassword(128, 32)
        $SecureString = ConvertTo-SecureString $SecurePassword -AsPlainText -Force
        
        Set-ADAccountPassword -Identity "krbtgt" -NewPassword $SecureString -Reset -Server $DomainController
        Write-Host "[+] Cycle 2 password update successful. Compromised key completely purged." -ForegroundColor Green
        Sync-ADObject -Object (Get-ADUser -Identity "krbtgt").DistinguishedName -Mode HighPriority
    }
}

Tier 2: Microsoft PAC Signature Validation Enforcement (CVE-2022-37967 / KB5020805)#

The primary architectural vulnerability enabling Diamond Tickets was the KDC's historical willingness to accept the Privilege Attribute Certificate (PAC) inside a TGT without validating that the PAC signatures were actually generated by the KDC or that the PAC requestor matched the ticket identity.

Microsoft addressed this vulnerability via security updates associated with CVE-2022-37967 and KB5020805, introducing new PAC buffers:

  • PAC_ATTRIBUTES_INFO: Contains flags specifying whether the PAC is cryptographically bound to the ticket client.
  • PAC_REQUESTOR: Carries the Security Identifier (SID) of the account that originally requested the ticket.
  • PAC_SERVER_CHECKSUM and PAC_PRIVSVR_CHECKSUM: Cryptographic signatures calculated over the PAC payload using the server key and KDC private key.

To prevent adversaries from injecting arbitrary SIDs into a decrypted TGT, blue teams must enforce strict KDC validation mode by configuring the PacSignatureValidationLevel registry key on all Domain Controllers.

Registry Configuration Runbook: Enforcing Level 3 (Enforcement Mode)

CMD 
:: Enforce PAC Signature Validation Level 3 on all Domain Controllers
:: Level 3: Full Enforcement - KDC strictly validates PAC signatures and rejects tickets with unverified or forged PACs
reg add "HKLM\SYSTEM\CurrentControlSet\Services\Kdc" /v PacSignatureValidationLevel /t REG_DWORD /d 3 /f

:: Verify registry setting
reg query "HKLM\SYSTEM\CurrentControlSet\Services\Kdc" /v PacSignatureValidationLevel
  • Mode 0 (Deployment Disabled): No PAC signature validation or requestor verification. Vulnerable to Diamond Tickets.
  • Mode 1 (Audit Mode): The KDC performs validation but logs warnings without rejecting tickets. Generates System Event IDs 35, 36, 37, and 38.
  • Mode 2 (Enforcement on Updated Clients): Partial enforcement.
  • Mode 3 (Full Enforcement): The KDC rejects any ticket where PAC signatures fail verification or where the PAC requestor SID fails validation, returning KDC_ERR_MODIFIED (0x29).

Tier 3: Privileged Identity Containment via Protected Users#

Adversaries rely on extracting TGTs from compromised administrative workstations or service hosts to manipulate their PACs. Restricting ticket lifetimes and credential delegation through the Active Directory Protected Users security group (introduced in Windows Server 2012 R2) significantly constrains this vector.

Architectural Controls Applied to Protected Users:

  1. Four-Hour Maximum TGT Lifetime: TGT validity is reduced from 10 hours to a strict 4-hour ceiling, preventing extended offline manipulation windows.
  2. Elimination of NTLM Authentication: Protected Users cannot authenticate using NTLM, digest authentication, or CredSSP, forcing pure Kerberos authentication.
  3. Disabling Kerberos Delegation: Protected Users cannot be delegated via Unconstrained or Constrained Delegation, neutralizing ticket forwarding attacks.
  4. Suppression of Credential Caching: Operating systems do not cache credentials or plaintext secrets in LSASS memory for Protected Users.

PowerShell Script: Provisioning Tier-0 Administrative Identities

POWERSHELL 
<#
.SYNOPSIS
    Harden-PrivilegedIdentities.ps1
    Adds Tier-0 administrative identities to Protected Users and enforces delegation blocks.
#>
[CmdletBinding()]
param(
    [Parameter(Mandatory = $true)]
    [string[]]$AdminAccounts
)

$ProtectedGroup = Get-ADGroup -Identity "Protected Users"

foreach ($Account in $AdminAccounts) {
    try {
        $UserObj = Get-ADUser -Identity $Account -Properties DoesNotRequirePreAuth, TrustedForDelegation, AccountNotDelegated
        
        # 1. Add to Protected Users Group
        Add-ADGroupMember -Identity $ProtectedGroup -Members $UserObj -ErrorAction Stop
        Write-Host "[+] Added $Account to Protected Users group." -ForegroundColor Green
        
        # 2. Enforce 'Account is sensitive and cannot be delegated'
        Set-ADUser -Identity $UserObj -AccountNotDelegated $true
        Write-Host "[+] Enforced AccountNotDelegated flag on $Account." -ForegroundColor Green
        
        # 3. Ensure Kerberos Pre-Authentication is strictly required
        if ($UserObj.DoesNotRequirePreAuth) {
            Set-ADUser -Identity $UserObj -DoesNotRequirePreAuth $false
            Write-Host "[+] Re-enabled Kerberos Pre-Authentication requirement on $Account." -ForegroundColor Yellow
        }
    }
    catch {
        Write-Error "[-] Failed to harden account $Account: $_"
    }
}

Tier 4: Kerberos Cryptographic Suite Hardening#

Adversaries often attempt to downgrade Kerberos encryption types to legacy RC4-HMAC (type 0x17) because its MD4-based hash derivation is computationally cheaper to brute-force and lacks modern cryptographic binding. Enforcing AES-256 (AES256-CTS-HMAC-SHA1-96, type 0x12) across all Domain Controllers and service accounts ensures that PAC checksums and ticket contents are protected by robust SHA-1 and HMAC primitives.

Group Policy Hardening for Kerberos Encryption Types:

  • Configure Network security: Configure encryption types allowed for Kerberos:
    • Set to: AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types.
    • Explicitly disable: DES_CBC_CRC, DES_CBC_MD5, RC4_HMAC_MD5.

Tier 5: Canary Service Accounts & Honeytoken SPNs#

To detect unauthorized Kerberos ticket requests before adversaries execute privilege escalation against production assets, security operations teams should deploy high-enticement canary service accounts across Active Directory.

Honeytoken Architecture and Implementation Principles:

  1. Attractive Principal Naming: Create unprivileged domain user accounts with deceptive administrative naming conventions (such as svc-sql-cluster-admin or backup-ad-sync).
  2. Assigning High-Value Service Principal Names: Register distinct Service Principal Names (SPNs) on the decoy accounts (e.g., MSSQLSvc/dc01.corp.internal:1433).
  3. Restricting Directory Entitlements: Decoy accounts are stripped of all actual directory permissions and placed in an isolated Organizational Unit (OU) with explicit logon restrictions.
  4. Autonomous SIEM Alerting: Because legitimate users and applications never authenticate to decoy canary SPNs, any Kerberos TGS-REQ (Event ID 4769) requesting tickets for these service principals serves as an immediate, high-fidelity indicator of reconnaissance, Kerberoasting, or ticket forging activity.

Production Detection Queries: Hunting PAC Anomalies & Privilege Discrepancies#

Because Diamond Tickets present valid cryptographic tickets issued by the KDC, perimeter detection must focus on behavioral discrepancies between the authenticated identity in the ticket and its actual entitlements in the directory database.

Detection Strategy 1: Sigma Rule for High-Privilege TGS Requests from Non-Admin Identities#

The following Sigma rule detects service ticket requests (TGS-REQ, Event ID 4769) requesting sensitive administrative SPNs (krbtgt, cifs/DC*, ldap/DC*) or exhibiting privileged service tickets where the requesting account is not an authorized member of Tier-0 groups.

YAML 
title: Kerberos Diamond Ticket Privilege Mismatch Hunting
id: c8b9e1d2-7f34-4b5a-9a8c-123456789abc
status: production
description: Detects suspicious Kerberos service ticket requests (Event ID 4769) where an unprivileged identity requests Tier-0 SPNs or manifests elevated PAC attributes.
references:
    - https://www.semperis.com/blog/a-diamond-ticket-in-the-ruff/
    - https://attack.mitre.org/techniques/T1558/001/

logsource:
    product: windows
    service: security
detection:
    selection_tgs:
        EventID: 4769
        Status: '0x0'
        TicketOptions|contains: '0x40810000' # Forwardable, Renewable, Canonicalize
    selection_spn:
        ServiceName|contains:
            - 'krbtgt'
            - 'cifs/'
            - 'ldap/'
    selection_encryption:
        TicketEncryptionType:
            - '0x12' # AES-256
            - '0x11' # AES-128
    filter_tier0_principals:
        TargetUserName|endswith:
            - '$' # Machine accounts (legitimate DC/server computer replication)
            - 'admin_svc'
            - 'da_*'
    condition: selection_tgs and selection_spn and selection_encryption and not filter_tier0_principals
falsepositives:
    - Authorized administrative jump hosts or scheduled backup tasks running under named service accounts.
level: high
tags:
    - attack.credential_access
    - attack.persistence
    - attack.t1558.001

Detection Strategy 2: PowerShell Hunt Script for Event 4769 and 4672 Discrepancies#

When an adversary uses a Diamond Ticket to authenticate against a Domain Controller, the DC's local LSA evaluates the modified PAC, extracts the injected Domain Admins SID, and assigns administrative user rights to the session. This action triggers Event ID 4672 (Special privileges assigned to new logon) containing privileges such as SeDebugPrivilege, SeTcbPrivilege, or SeBackupPrivilege—associated with an account that is actually an ordinary unprivileged domain user.

POWERSHELL 
<#
.SYNOPSIS
    Hunt-DiamondTicketPrivilegeMismatch.ps1
    Correlates Kerberos TGS-REQ (Event 4769) with Special Privilege Assignment (Event 4672).
.DESCRIPTION
    Scans Domain Controller security event logs for accounts receiving administrative
    logon privileges whose Active Directory account is not a member of Domain Admins.
#>
[CmdletBinding()]
param(
    [Parameter(Mandatory = $false)]
    [int]$HoursToScan = 24,

    [Parameter(Mandatory = $false)]
    [string]$DomainController = $env:LOGONSERVER.TrimStart('\')
)

Import-Module ActiveDirectory -ErrorAction Stop

$StartTime = (Get-Date).AddHours(-$HoursToScan)
Write-Host "[*] Auditing Event 4672 / 4769 privilege anomalies on $DomainController since $StartTime..." -ForegroundColor Cyan

# Step 1: Query legitimate Tier-0 group members
$Tier0Members = (Get-ADGroupMember -Identity "Domain Admins" -Recursive).SamAccountName
$EnterpriseAdmins = (Get-ADGroupMember -Identity "Enterprise Admins" -Recursive).SamAccountName
$KnownAdmins = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
$Tier0Members + $EnterpriseAdmins | ForEach-Object { [void]$KnownAdmins.Add($_) }

# Step 2: Query Event 4672 (Special Privileges Assigned)
$FilterXml = @"
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4672) and TimeCreated[@SystemTime &gt;= '$($StartTime.ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ss.fffZ"))']]]
    </Select>
  </Query>
</QueryList>
"@

$Events = Get-WinEvent -FilterXml $FilterXml -ComputerName $DomainController -ErrorAction SilentlyContinue

$Anomalies = @()

foreach ($Event in $Events) {
    $Xml = [xml]$Event.ToXml()
    $Data = $Xml.Event.EventData.Data
    
    $AccountName = ($Data | Where-Object { $_.Name -eq 'SubjectUserName' }).'#text'
    $LogonId = ($Data | Where-Object { $_.Name -eq 'SubjectLogonId' }).'#text'
    $PrivilegeList = ($Data | Where-Object { $_.Name -eq 'PrivilegeList' }).'#text'
    
    # Ignore machine accounts and verified Tier-0 administrators
    if ($AccountName -like '*$' -or $KnownAdmins.Contains($AccountName)) {
        continue
    }
    
    # Flag any unprivileged user granted critical administrator privileges
    if ($PrivilegeList -match 'SeDebugPrivilege|SeTcbPrivilege|SeBackupPrivilege') {
        $Anomalies += [PSCustomObject]@{
            TimeGenerated = $Event.TimeCreated
            TargetUser    = $AccountName
            LogonId       = $LogonId
            AssignedPrivs = $PrivilegeList.Trim()
            DirectoryTier = "UNPRIVILEGED USER (POSSIBLE PAC FORGERY)"
        }
    }
}

if ($Anomalies.Count -gt 0) {
    Write-Host "[!] CRITICAL: Found $($Anomalies.Count) anomalous privilege assignments indicating potential Diamond Ticket abuse!" -ForegroundColor Red
    $Anomalies | Format-Table -AutoSize
} else {
    Write-Host "[+] Zero privilege discrepancies detected in the audited window." -ForegroundColor Green
}

Enterprise Mitigation Matrix: Comparing Remediations for Diamond Ticket Defense#

The following comparative matrix evaluates defense-in-depth remediations for Active Directory environments against Kerberos Diamond Ticket attacks:

Mitigation Strategy Architectural Layer Effectiveness vs Diamond Ticket Operational Impact & Outage Risk Deployment Complexity Verification Method
Dual KRBTGT Password Rotation Forest Root Key Lifecycle Complete Invalidation: Eradicates compromised key from active and historic memory slots. Low (if 24-hr replication window is strictly maintained). High if executed concurrently. Moderate (requires scripting and multi-DC validation). Query msDS-KeyVersionNumber across all DCs to confirm kvno increments by +2.
KDC PAC Validation Level 3 KDC Ticket Protocol Engine Cryptographic Rejection: Blocks tickets with forged PAC signatures or unverified requestors. Low (requires up-to-date Windows Server patches across all domain DCs). Low (registry key deployment via Group Policy). Verify PacSignatureValidationLevel = 3 and audit System Event Logs for zero Event 37/38.
Protected Users Group Containment Identity Governance & Policy High Containment: Restricts TGT lifetime to 4h and prohibits ticket delegation. Moderate (breaks legacy NTLM applications and unconstrained delegation dependencies). Moderate (requires auditing administrative service accounts). Execute Get-ADGroupMember 'Protected Users' and audit client TGT lifetimes via klist.
Tier-0 PAW & Administrative Isolation Endpoint & Access Control Proactive Prevention: Prevents credential theft by isolating administrative credentials from user hosts. Moderate (requires dedicated hardware or isolated hypervisor tiers). High (requires architectural redesign of administrative access). Audit logon events (Event 4624) to ensure Tier-0 accounts only log on to Tier-0 PAWs.
Kerberos AES-256 Protocol Hardening Cryptographic Cipher Suite Protocol Hardening: Eliminates weak RC4-HMAC ciphers and enforces modern SHA-1 HMAC checks. Low-Moderate (requires checking legacy non-Windows Kerberos clients). Low (configured via Domain Controller Group Policy). Inspect Event ID 4769 TicketEncryptionType to confirm 0x12 (AES-256) exclusivity.
Event 4769 & 4672 SIEM Correlation Telemetry & Threat Hunting High Detection Fidelity: Surfaces unauthorized privilege elevation granted via modified PACs. Zero operational impact (passive monitoring). Moderate (requires log pipeline integration and directory group synchronization). Execute synthetic canary tests and verify SIEM alert generation on privilege mismatches.

Incident Response & Verification Playbook: Blue Team Containment & Auditing#

When Active Directory monitoring flags suspected Diamond Ticket activity or when krbtgt credential compromise is suspected, blue teams must execute the following structured incident response playbook.

Phase 1: Rapid Triage & Blast Radius Identification#

  • Isolate Compromised Systems: Immediately disconnect suspected administrative workstations or staging jump boxes from the network to prevent further ticket harvesting.
  • Audit KDC PAC Validation Logs: Inspect Domain Controller System logs for Event IDs 35, 36, 37, and 38. Event 37 (The KDC encountered a ticket with an invalid PAC signature) indicates active PAC tampering or unpatched clients.
  • Cross-Reference Event 4768 and Event 4769: Extract all Kerberos AS-REQ (4768) and TGS-REQ (4769) logs for the suspected user account. Identify whether high-privilege service tickets (krbtgt, cifs/) were granted to accounts that lack administrative group membership in Active Directory.
  • Examine Ticket Options Bitmasks: Inspect the hex values inside Event 4769 TicketOptions. Values containing 0x40810000 represent forwardable, renewable, and canonicalized tickets that frequently characterize forged session interactions.

Phase 2: Containment & First-Cycle Key Rotation#

  • Verify DC Replication Health: Run repadmin /replsummary and repadmin /showrepl across all Domain Controllers to guarantee zero replication blockages before modifying domain credentials.
  • Execute KRBTGT Rotation Cycle 1: Run Rotate-KRBTGT-Production.ps1 -ExecutionPhase Cycle1 against the Primary Domain Controller (PDC) emulator.
  • Force Immediate High-Priority Replication: Execute repadmin /syncall /AdeP to propagate the updated krbtgt password object across all forest DCs.
  • Purge Local Kerberos Caches on Tier-0 Hosts: On all Domain Controllers and Privileged Access Workstations (PAWs), execute klist purge to flush cached service tickets.

Phase 3: Eradication & Second-Cycle Key Purge#

  • Maintain the 24-Hour Quarantine Window: Monitor Active Directory replication and client authentication health. Allow legitimate client TGTs (standard 10-hour lifetime) to expire and renew cleanly under the new krbtgt key.
  • Execute KRBTGT Rotation Cycle 2: Run Rotate-KRBTGT-Production.ps1 -ExecutionPhase Cycle2. This permanently removes the compromised key from msDS-KrbTgtLinkBl.
  • Verify Key Version Number (kvno) Alignment: Confirm that Get-ADUser krbtgt -Properties "msDS-KeyVersionNumber" returns an identical kvno incremented by +2 across every Domain Controller in the forest.
  • Reset Administrative Account Credentials: Force password resets across all members of Domain Admins, Enterprise Admins, Schema Admins, and built-in local administrator accounts.

Phase 4: Recovery, Post-Incident Hardening & Ongoing Telemetry#

  • Enforce KDC PAC Validation Level 3: Apply PacSignatureValidationLevel = 3 via Group Policy across all Domain Controllers.
  • Populate Protected Users Group: Add all human administrative identities to the Protected Users security group.
  • Enable High-Fidelity SIEM Hunting Rules: Deploy the Sigma rule for Event 4769/4672 privilege mismatch hunting into production SIEM pipelines.
  • Conduct Post-Mortem Audit: Review DC security event logs over the subsequent 72 hours to verify zero authentication failures from legitimate enterprise services.

Executive Takeaway Table: Threat Vectors, Detection Signals, and Primary Mitigations#

The following executive reference summarizes the Diamond Ticket threat surface, primary detection indicators, and mandatory architectural controls:

Threat Vector / Phase Root Architectural Cause High-Fidelity Detection Signal Primary Blue Team Hardening Control
Initial TGT Generation (AS-REQ) Valid low-privilege domain account credential compromise. Normal Event 4768 logging, but initiated from anomalous hosts or off-hours. Enforce MFA via Smart Card / FIDO2 and monitor anomalous initial logons.
Offline PAC Tampering & Modification Possessing krbtgt key allows adversary to decrypt, inject SIDs, and re-sign PAC. None on endpoints (tampering occurs offline in attacker memory space). Dual krbtgt password rotation runbook; limit access to Active Directory backup files (NTDS.dit).
TGS Service Ticket Request (TGS-REQ) KDC historically accepted PAC without verifying requestor identity or KDC signature. Event 4769 requesting high-privilege SPNs (cifs/DC*, krbtgt) from non-admin accounts. Enforce Microsoft PAC Validation Level 3 (PacSignatureValidationLevel = 3).
Target Service Access & Privilege Grant Service host accepts modified PAC and grants administrative access tokens. Event 4672 (Special Privileges Assigned) logged for standard user account. Place administrative users in Protected Users and enforce Tier-0 Privileged Access Workstations (PAWs).
Persistence via Stolen Key Compromised krbtgt key remains valid until purged from directory history. Continued issuance of unauthorized service tickets across multiple days. Execute second krbtgt rotation after 24 hours to purge historic key (msDS-KrbTgtLinkBl).

Authoritative References & Further Reading#

  1. Semperis Research: Diamond Tickets — Defending Against Hidden Kerberos Attacks
    https://www.semperis.com/blog/a-diamond-ticket-in-the-ruff/
  2. Microsoft Support: KB5020805: How to manage Kerberos protocol changes related to CVE-2022-37967
    https://support.microsoft.com/en-us/servicing/os/windows-server/2022/10/kb5020805-how-to-manage-kerberos-protocol-changes-related-to-cve-2022-37967
  3. Microsoft Protocol Documentation: [MS-PAC]: Privilege Attribute Certificate Data Structure Specification
    https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/
  4. IETF RFC 4120: The Kerberos Network Authentication Service (V5)
    https://www.rfc-editor.org/rfc/rfc4120
  5. MITRE ATT&CK Framework: Technique T1558.001 — Steal or Forge Kerberos Tickets: Golden Ticket and Diamond Ticket
    https://attack.mitre.org/techniques/T1558/001/

Comments

Post a Comment

Drag or use arrow keys to pan • Click outside or press Esc to close