Hardening Active Directory Kerberos: PAC Validation & Diamond Ticket Defense

Md. Redwan Ahmed Md. Redwan Ahmed
·
Hardening Active Directory Kerberos: PAC Validation & Diamond Ticket Defense

Overview & Defensive Context: Kerberos Ticket Forgery & EDR Blind Spots#

Diamond Tickets forge TGT PACs using stolen KRBTGT keys while evading Golden Ticket rules. Enforce CVE-2022-37967 PAC signatures and key rotation.

In our morning architecture breakdown, we deconstructed the offensive mechanics of the Kerberos Diamond Ticket attack (mapped to MITRE ATT&CK T1558.001 and T1548). Unlike traditional Golden Tickets that generate completely synthetic Ticket Granting Tickets (TGTs) from scratch—leaving obvious telemetry anomalies such as missing Event ID 4768 (A Kerberos authentication ticket was requested), non-standard encryption types (RC4-HMAC etype 23), and arbitrary 10-year validity windows—Diamond Tickets execute an in-place modification of a genuine, KDC-issued TGT.

The adversary issues a legitimate AS-REQ to the Domain Controller for a standard, unprivileged user account. The Key Distribution Center (KDC) validates the request, logs an authentic Event ID 4768, and returns a legitimate AS-REP. Using a stolen krbtgt AES-256 key (etype 18), the attacker decrypts the EncTicketPart offline, modifies the embedded Privilege Attribute Certificate (PAC) (MS-PAC) within KERB_VALIDATION_INFO to inject elevated group Security Identifiers (such as Domain Admins RID 512 or Enterprise Admins RID 519), recalculates cryptographic PAC signatures, and re-encrypts the ticket.

When presented in subsequent service ticket requests (TGS-REQ), the Domain Controller receives a ticket that possesses 100% forensic fidelity with the domain's Kerberos policy: genuine timestamps, authentic pre-authentication nonces, standard ticket lifetimes, and a verified Event ID 4768 predecessor log.

Attack Technique KDC Event ID 4768 Policy Timestamps PAC Integrity
Golden Ticket (T1558.001) MISSING (Anomaly) Anomalous (e.g., 10 Years) Forged Synthetic PAC
Diamond Ticket (T1558) AUTHENTIC (Present) 100% Policy Compliant Modified Legitimate PAC
Sapphire Ticket (S4U) AUTHENTIC (Present) Legitimate S4U PAC Impersonated PAC Graft

Defending Active Directory environments against Diamond Tickets exposes critical limitations in legacy perimeter and endpoint monitoring models:

  • The Fallacy of Event ID 4768 Absence Detection: The most prominent detection heuristic for Golden Tickets relies on flagging Event ID 4769 (A Kerberos service ticket was requested) that lacks a matching Event ID 4768 on any Domain Controller. Because Diamond Tickets initiate with a real, authenticated AS-REQ, this rule yields zero alerts.
  • Perimeter Network Inspection Blindness: Kerberos traffic between endpoints and Domain Controllers occurs over TCP/UDP port 88. The EncTicketPart is encrypted using the domain's secret krbtgt key. Network Intrusion Detection Systems (NIDS) and perimeter firewalls cannot inspect the encrypted ticket payload or detect that the PAC inside the TGT has been altered offline.
  • Service-Side Validation Gaps: By default in unpatched or legacy Active Directory environments, application servers receiving service tickets do not verify the PAC signatures with the Domain Controller; they blindly trust the decrypted service ticket session.
  • Stale KRBTGT Keys and Inadequate Rotation: Many organizations maintain krbtgt accounts whose passwords have not been rotated in years. A compromised krbtgt key grants persistent ticket-forgery capability until the key is rotated twice, which requires strict synchronization with the domain's maximum ticket lifetime policy.
Warning

If your Security Operations Center relies strictly on "Missing Event 4768" queries to identify Kerberos TGT forgery, your enterprise is completely blind to Diamond Tickets. Mitigating this threat requires enforcing cryptographic PAC signature verification under CVE-2022-37967, deploying behavioral correlation rules, and executing rigorous Tier-0 identity lifecycle controls.

⚔️ Exploitation Mechanics: For root-cause memory corruption analysis and attack flow, see our deep-dive: Kerberos Diamond Ticket: Deconstructing TGT Forgery Architecture.

Architecture Hardening: Multi-Layered Active Directory Defense#

Securing Active Directory against Diamond Tickets demands a comprehensive defense-in-depth architecture across four operational rings: Enforcing Cryptographic PAC Signatures (CVE-2022-37967 / KB5020805), Automated Double-KRBTGT Rotation Lifecycles, Protected Users Group & Tier-0 Segmentation, and Behavioral Ticket-to-Identity Correlation.

Defense Architecture Flowchart#

flowchart TD
    classDef client fill:#1e293b,stroke:#ef4444,stroke-width:2px,color:#f8fafc
    classDef gate fill:#0f172a,stroke:#3b82f6,stroke-width:2px,color:#93c5fd
    classDef kdc fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#6ee7b7
    classDef audit fill:#4c1d95,stroke:#8b5cf6,stroke-width:2px,color:#ddd6fe
    classDef drop fill:#450a0a,stroke:#dc2626,stroke-width:2px,color:#fca5a5
    classDef pass fill:#065f46,stroke:#34d399,stroke-width:2px,color:#a7f3d0

    ClientTGS[Client Submits TGT in TGS-REQ to KDC]:::client --> KDCEntry{Ring 1: KDC Inbound Transport Inspection}:::gate

    KDCEntry -- Legacy RC4-HMAC etype 23 Detected --> DropRC4[Action: Reject Legacy Cipher Fallback]:::drop
    KDCEntry -- Modern AES-256 etype 18 Accepted --> PACSignCheck{Ring 2: CVE-2022-37967 Enforce Mode Gate}:::gate

    PACSignCheck -- PAC_TICKET_CHECKSUM Missing or Invalid --> DropPAC[Action: KDC Logs System Event 37-40 & Denies Ticket]:::drop
    PACSignCheck -- Full Cryptographic PAC Signatures Verified --> AttribCheck{Ring 3: Extended PAC Attributes & SID Validation}:::kdc

    AttribCheck -- PAC SIDs Conflict with Active Directory Object --> DropSID[Action: Block Ticket & Flag Anomaly in SIEM]:::drop
    AttribCheck -- Requestor SID and Group SIDs Match AD State --> ServiceTicket[KDC Issues Legitimate Service Ticket TGS-REP]:::pass

    ServiceTicket --> Tier0Check{Ring 4: Tier-0 Target Boundary Evaluation}:::kdc
    Tier0Check -- Non-Protected User Accessing Sensitive Target --> AlertPUG[Action: Apply Restricted Admin / PUG Control]:::gate
    Tier0Check -- Authorized Privileged Session --> TargetAccess[Target Service Authenticates Legitimate Client]:::pass

    DropPAC -.-> TelemetryStream[Ring 5: SIEM & EDR Telemetry Pipeline]:::audit
    DropSID -.-> TelemetryStream
    TelemetryStream --> SOCAlert[SOC Incident Response Triggered]:::pass

Layer 1: Enforcing Cryptographic PAC Signatures (CVE-2022-37967 / KB5020805)#

Microsoft addressed Kerberos privilege elevation flaws by introducing strict PAC signatures in security update KB5020805 addressing CVE-2022-37967 and CVE-2022-37966. This update updated the MS-PAC protocol to include a new PAC_TICKET_CHECKSUM (buffer type 0x0011) and a Full PAC Signature.

In a fully patched Active Directory environment running in Full Enforcement Mode, the KDC verifies that:

  1. The PAC contains a valid Server Signature (PAC_SERVER_SIGNATURE, buffer type 0x0006).
  2. The PAC contains a valid KDC Signature (PAC_KDC_SIGNATURE, buffer type 0x0007).
  3. The PAC contains a valid Ticket Checksum (PAC_TICKET_CHECKSUM, buffer type 0x0011), which cryptographically binds the signatures to the full raw ticket bytes.
  4. The user account's SID in the PAC matches the Active Directory user object identity.

If an attacker modifies KERB_VALIDATION_INFO inside a Diamond Ticket, they must recalculate all checksums. To guarantee complete enforcement across all Domain Controllers, verify the registry setting under HKLM\System\CurrentControlSet\Services\Kdc:

POWERSHELL 
# Verify and configure Kerberos PAC signature enforcement mode on Domain Controllers
# PacSignatures values:
# 0 = Default / Audit Mode (Vulnerable to forged PAC bypasses)
# 1 = Deployment / Audit Mode (Logs warnings Event ID 35-38)
# 2 = Full Enforcement Mode (Denies any ticket without valid signatures)

$RegistryPath = "HKLM:\System\CurrentControlSet\Services\Kdc"
$ValueName    = "PacSignatures"

# Inspect current configuration
$CurrentSetting = Get-ItemProperty -Path $RegistryPath -Name $ValueName -ErrorAction SilentlyContinue

if ($null -eq $CurrentSetting -or $CurrentSetting.PacSignatures -ne 2) {
    Write-Warning "KDC is NOT in Full Enforcement Mode! Configuring PacSignatures = 2..."
    New-ItemProperty -Path $RegistryPath -Name $ValueName -Value 2 -PropertyType DWord -Force | Out-Null
    Write-Host "[+] Successfully configured PacSignatures to Full Enforcement Mode (Value: 2)." -ForegroundColor Green
} else {
    Write-Host "[+] KDC is operating in Full Enforcement Mode (PacSignatures = 2)." -ForegroundColor Green
}
Important

Since the October 2023 / April 2024 cumulative updates, Windows Server Domain Controllers enforce PacSignatures=2 by default. However, legacy domain functional levels, unpatched auxiliary Domain Controllers, or registry overrides (PacSignatures=0) leave the KDC susceptible to forged PAC injection.

Layer 2: Automated Double-KRBTGT Password Rotation Protocol#

The krbtgt account key is the root-of-trust for the entire Kerberos domain. If an adversary dumps the krbtgt password hash (via DCSync, NTDS.dit extraction, or LSASS memory scraping), they possess the cryptographic material required to forge Diamond Tickets.

Active Directory maintains a password history for krbtgt consisting of the current key and the immediately preceding key (krbtgt_history). This ensures that service tickets and TGTs issued prior to a password reset remain valid until their expiration. Therefore, rotating the krbtgt password once does NOT invalidate forged tickets; the adversary can still use the previous key.

To permanently eradicate forged ticket persistence, administrators must execute a Double-KRBTGT Password Rotation separated by the domain's maximum ticket lifetime (MaxTicketAge, default 10 hours) plus replication latency:

flowchart TD
    classDef step fill:#1e293b,stroke:#3b82f6,stroke-width:2px,color:#93c5fd
    classDef wait fill:#0f172a,stroke:#f59e0b,stroke-width:2px,color:#fef3c7
    classDef done fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#6ee7b7

    R1["Hour 0:00: First KRBTGT Password Reset
Current Key becomes Previous Key • Oldest Key purged"]:::step
    WAIT["Hour 0-12: Replication & Expiration Buffer
Allow legitimate user TGTs to naturally expire (10h max lifetime)
Active Directory replication converges across all forest DCs"]:::wait
    R2["Hour 12:00: Second KRBTGT Password Reset
First new key becomes Previous Key • Compromised key eradicated permanently"]:::done

    R1 --> WAIT --> R2

Deploy the following PowerShell procedure to safely manage and audit the krbtgt lifecycle:

POWERSHELL 
# Active Directory KRBTGT Lifecycle Audit & Rotation Script
Import-Module ActiveDirectory

function Get-KrbtgtLifecycleStatus {
    [CmdletBinding()]
    param()

    $Krbtgt = Get-ADUser -Identity "krbtgt" -Properties PasswordLastSet, msDS-KeyCredentialLink, whenChanged
    $DomainPolicy = Get-ADDefaultDomainPasswordPolicy
    $KerbPolicy = Get-ADDomain | Select-Object -ExpandProperty MaxTicketAge

    $LastSet = $Krbtgt.PasswordLastSet
    $AgeDays = (New-TimeSpan -Start $LastSet -End (Get-Date)).Days

    [PSCustomObject]@{
        AccountName         = "krbtgt"
        PasswordLastSet     = $LastSet
        KeyAgeDays          = $AgeDays
        RotationRecommended = ($AgeDays -gt 180)
        DomainMaxTicketAge  = if ($KerbPolicy) { $KerbPolicy } else { "10 Hours (Default)" }
    }
}

# Execute status inspection
$Status = Get-KrbtgtLifecycleStatus
$Status | Format-List

Layer 3: Protected Users Security Group & Tier-0 Administrative Isolation#

Diamond Tickets weaponize standard user accounts by elevating their group membership in memory to Domain Admins or Enterprise Admins. To mitigate the impact of ticket tampering and prevent the credential theft that enables it, enforce Active Directory Administrative Tiering:

  1. Add Privileged Accounts to Protected Users: Accounts enrolled in the Protected Users security group (introduced in Windows Server 2012 R2) receive kernel-level Kerberos protections:
    • NTLM authentication is disabled; only Kerberos is permitted.
    • Credential caching in LSASS is suppressed (no plain text, no NTLM hash caching).
    • Kerberos TGT lifetime is restricted to a maximum of 4 hours instead of 10 hours.
    • Delegated credentials (Unconstrained or Constrained Delegation) cannot be leveraged.
POWERSHELL 
# Add all Tier-0 administrative accounts to Protected Users Group
$Tier0Users = Get-ADGroupMember -Identity "Domain Admins" | Where-Object { $_.objectClass -eq "user" }

foreach ($User in $Tier0Users) {
    Add-ADGroupMember -Identity "Protected Users" -Members $User.DistinguishedName -ErrorAction SilentlyContinue
    Write-Host "[+] Enrolled Tier-0 user $($User.SamAccountName) into Protected Users group." -ForegroundColor Green
}
  1. Restrict Outbound RPC and SAMR Access to Domain Controllers: Attackers dump krbtgt via DCSync using the Directory Replication Service Remote Protocol (MS-DRSR). Enforce host-based Windows Defender Firewall rules on all Domain Controllers to block inbound RPC endpoint mapper (TCP 135) and high-range dynamic RPC ports (TCP 49152-65535) from non-DC IP subnets.

Production Detection Queries: Sigma Rule, Telemetry & Audit Configuration#

Detecting Diamond Tickets requires correlating authentication events across the KDC and inspecting anomalies between requested Kerberos privileges and directory object attributes.

1. Production Sigma Rule: Diamond Ticket Behavioral Detection#

The following production-ready Sigma rule identifies anomalous TGS-REQ service ticket requests where a user requests elevated administrative access (such as accessing cifs/DC01 or krbtgt/DOMAIN) using a TGT that claims privileged group memberships (Domain Admins RID 512, Enterprise Admins RID 519) that do not belong to that account in Active Directory.

YAML 
title: Kerberos Diamond Ticket TGS Privilege Discrepancy
id: 7c94b62d-98e3-4f1b-a563-3e7215e9821a
status: production
description: |
    Detects potential Kerberos Diamond Ticket attacks where a user account requests 
    service tickets (Event 4769) for privileged services or with elevated SIDs, 
    but the underlying Active Directory account is not an authentic member of those privileged groups.
references:
    - https://www.semperis.com/blog/a-diamond-ticket-in-the-ruff/
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/
    - https://support.microsoft.com/en-us/topic/kb5020805

tags:
    - attack.credential_access
    - attack.privilege_escalation
    - attack.t1558.001
    - attack.t1548
logsource:
    product: windows
    service: security
detection:
    selection_tgs:
        EventID: 4769
        Status: '0x0'
        TicketEncryptionType:
            - '0x12' # AES256-CTS-HMAC-SHA1-96
            - '0x11' # AES128-CTS-HMAC-SHA1-96
    privileged_services:
        ServiceName|startswith:
            - 'krbtgt/'
            - 'cifs/'
            - 'ldap/'
            - 'host/'
    filter_known_admins:
        TargetUserName|endswith:
            - '$' # Exclude computer accounts
    condition: selection_tgs and privileged_services and not filter_known_admins
fields:
    - TargetUserName
    - ServiceName
    - ServiceSid
    - TicketOptions
    - TicketEncryptionType
    - IpAddress
falsepositives:
    - Legitimate administrative users requesting service tickets during normal operations.
    - Requires correlation against Active Directory LDAP user group membership.
level: high

2. KDC System Log Audit Rules: Detecting PAC Signature Failures#

When a Domain Controller rejects an invalid or modified Diamond Ticket under CVE-2022-37967, the KDC generates specific diagnostic events in the System event log:

Event ID Log Provider Event Severity Trigger Condition & Diagnostic Meaning
Event ID 35 Microsoft-Windows-Kerberos-Key-Distribution-Center Warning KDC encountered a PAC missing a Ticket Checksum (PAC_TICKET_CHECKSUM). Logged in audit mode.
Event ID 37 Microsoft-Windows-Kerberos-Key-Distribution-Center Error PAC verification failed because the Ticket Checksum failed cryptographic validation against the ticket body.
Event ID 38 Microsoft-Windows-Kerberos-Key-Distribution-Center Error PAC verification failed because the KDC Signature failed cryptographic verification using the KDC key.
Event ID 39 Microsoft-Windows-Kerberos-Key-Distribution-Center Error PAC verification failed because the Server Signature failed verification using the target service key.
Event ID 40 Microsoft-Windows-Kerberos-Key-Distribution-Center Error PAC verification failed because extended attributes or security identifiers were tampered with or unparseable.

Deploy the following PowerShell monitoring agent on all Domain Controllers to trigger high-priority security alerts upon any PAC validation failure:

POWERSHELL 
# Active Directory PAC Signature Verification Alert Monitor
$FilterHashtable = @{
    LogName   = 'System'
    ProviderName = 'Microsoft-Windows-Kerberos-Key-Distribution-Center'
    Id        = 35, 36, 37, 38, 39, 40
    StartTime = (Get-Date).AddHours(-1)
}

$Events = Get-WinEvent -FilterHashtable $FilterHashtable -ErrorAction SilentlyContinue

if ($Events) {
    foreach ($Event in $Events) {
        Write-Warning "CRITICAL: Kerberos PAC Signature Verification Failure Detected!"
        [PSCustomObject]@{
            TimeCreated   = $Event.TimeCreated
            EventID       = $Event.Id
            Level         = $Event.LevelDisplayName
            Message       = $Event.Message
            DomainController = $env:COMPUTERNAME
        } | Format-List
    }
} else {
    Write-Host "[+] Zero PAC signature verification errors detected in the last hour." -ForegroundColor Green
}

3. Splunk / Elastic SIEM Hunting Query: Ticket-to-Identity Correlation#

To hunt for Diamond Tickets in large enterprises where Event ID 4768 and 4769 logs are ingested into a central SIEM, execute the following correlation query. This query detects low-privileged users that successfully request administrative services without possessing administrative group SIDs in Active Directory:

SQL 
-- SIEM Detection Query: Diamond Ticket SId Inconsistency Hunting
SELECT 
    tgs.TimeCreated AS TgsTime,
    tgs.TargetUserName AS AccountName,
    tgs.ServiceName AS RequestedService,
    tgs.IpAddress AS ClientIP,
    tgt.TimeCreated AS AsReqTime,
    tgt.TicketOptions AS AsReqOptions
FROM WinEventLog_Security_4769 tgs
JOIN WinEventLog_Security_4768 tgt 
    ON tgs.TargetUserName = tgt.TargetUserName 
    AND tgs.TargetSid = tgt.TargetSid
WHERE tgs.ServiceName LIKE 'cifs/%' 
   OR tgs.ServiceName LIKE 'ldap/%'
   AND tgs.TargetUserName NOT IN (
       SELECT UserName FROM ActiveDirectory_DomainAdmins_Cache
   )
ORDER BY tgs.TimeCreated DESC;

Enterprise Mitigation Matrix: Workarounds, Hotfixes & Architecture#

When hardening enterprise Active Directory infrastructure against Kerberos ticket forgery, security architects must weigh operational disruptions against cryptographic resilience:

Remediation Strategy Implementation Effort Blast Radius & Operational Risk Detection & Prevention Efficacy Performance Overhead Architectural Longevity
Workaround: Strict Kerberos Event Logging & SIEM Hunting 2 - 4 Hours
(Enable Advanced Audit Policy for Kerberos; deploy SIEM correlation)		 Low
Increases Domain Controller log volume by ~15-20%.		 Moderate (65%)
Detects discrepancies post-exploitation; does not block ticket issuance.		 Low
Domain Controller event forwarding overhead.		 Tactical Visibility
Essential for SOC triage but fails to prevent domain takeover.
Hotfix: Enforce CVE-2022-37967 Full PAC Validation (PacSignatures=2) 1 - 2 Days
(Install latest Windows Server cumulative updates; verify registry on all DCs)		 Moderate
Legacy Linux/NAS appliances using unpatched Kerberos stacks may experience auth drops.		 High (95%)
Validates full PAC ticket checksums; rejects modified PACs missing KDC signatures.		 < 1%
Cryptographic HMAC validation per service ticket request.		 Mandatory Standard
Permanently fixes cryptographic weaknesses in MS-PAC specification.
Operational Control: Automated Semi-Annual Double-KRBTGT Rotation 2 - 4 Days
(Schedule automated 12-hour delayed double-reset via PowerShell script)		 High
Risk of user authentication disruptions if second reset occurs before MaxTicketAge.		 Absolute for Stolen Keys (100%)
Permanently invalidates all previously stolen AES keys and active forged TGTs.		 Zero
Standard directory operation.		 Core Hygiene Pillar
Eliminates attacker persistence across entire Active Directory forest.
Architecture Fix: Enterprise Tiering, Protected Users & PAWs 4 - 8 Weeks
(Deploy Privileged Access Workstations; enroll admins in Protected Users group)		 Substantial
Requires restructuring IT administrative workflows and credentials.		 Comprehensive (100%)
Prevents LSASS credential harvesting that yields the KRBTGT key.		 Negligible
Architectural isolation.		 Strategic State
Zero-trust administrative architecture immune to credential compromise.
Caution

Never execute the second krbtgt password reset immediately following the first. If both resets are performed within a few minutes, every active user, computer, and service ticket across the entire Active Directory domain will be invalidated instantly, resulting in catastrophic enterprise-wide authentication failure. Always maintain a minimum hold of 10 to 12 hours between resets.

Incident Response & Verification Playbook: Diamond Ticket Triage & Eradication#

If a compromised krbtgt key or Diamond Ticket forgery attack is suspected in your domain, follow this four-phase incident response playbook immediately:

flowchart TD
    classDef alert fill:#450a0a,stroke:#dc2626,stroke-width:2px,color:#fca5a5
    classDef check fill:#1e293b,stroke:#f59e0b,stroke-width:2px,color:#fef3c7
    classDef triage fill:#0f172a,stroke:#3b82f6,stroke-width:2px,color:#93c5fd
    classDef clean fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#6ee7b7

    Triage[Phase 1: Forensic KDC Log Correlation & TGT Audit]:::triage --> CorrelateEvents{Check Event 4769 SIDs against Active Directory Object}:::check

    CorrelateEvents -- Discrepancy Found: Unprivileged User with DA SIDs --> IsolateHost[Phase 2: Immediate Containment & Host Isolation]:::alert
    CorrelateEvents -- SIDs Match Directory --> CheckPACErrors{Check System Event 37-40 PAC Errors}:::check

    CheckPACErrors -- Cryptographic Checksum Failure Confirmed --> IsolateHost
    CheckPACErrors -- Clean Logs --> CloseIncident[Close Incident as False Positive]:::clean

    IsolateHost --> PurgeTickets[Phase 3: Purge Kerberos Ticket Caches on KDCs]:::alert
    PurgeTickets --> Reset1[Execute First KRBTGT Password Reset]:::alert

    Reset1 --> ReplicationWait[Hold 10-12 Hours for Ticket Expiration & Replication]:::check
    ReplicationWait --> Reset2[Execute Second KRBTGT Password Reset]:::alert

    Reset2 --> Phase4[Phase 4: Post-Remediation Hardening & Verification]:::clean

Phase 1: Live Triage & Forensic Ticket Audit#

  1. Query KDC Authentication Logs (Event ID 4768 and 4769): Identify the suspected compromised account and inspect all recent service tickets requested within the past 24 hours:
POWERSHELL 
# Forensic inspection of Kerberos TGT and TGS requests
$SuspectUser = "jdoe"
$StartTime   = (Get-Date).AddHours(-24)

# Retrieve AS-REQ events
$TgtEvents = Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4768
    StartTime = $StartTime
} | Where-Object { $_.Properties[0].Value -eq $SuspectUser }

# Retrieve TGS-REQ events
$TgsEvents = Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4769
    StartTime = $StartTime
} | Where-Object { $_.Properties[0].Value -eq $SuspectUser }

Write-Host "[*] AS-REQ Events Found: $($TgtEvents.Count)" -ForegroundColor Cyan
Write-Host "[*] TGS-REQ Events Found: $($TgsEvents.Count)" -ForegroundColor Cyan

# Inspect service targets for Tier-0 services
$TgsEvents | Select-Object TimeCreated, 
    @{N='Service'; E={$_.Properties[1].Value}}, 
    @{N='TicketEncryption'; E={$_.Properties[4].Value}}, 
    @{N='ClientIP'; E={$_.Properties[9].Value}} | Format-Table -AutoSize
  1. Inspect System Event Log for PAC Signature Rejections: Verify whether the Domain Controller logged any signature mismatch events (Event ID 37, 38, 39, 40):
POWERSHELL 
Get-WinEvent -FilterHashtable @{
    LogName   = 'System'
    ProviderName = 'Microsoft-Windows-Kerberos-Key-Distribution-Center'
    Id        = 37, 38, 39, 40
    StartTime = (Get-Date).AddHours(-24)
} | Format-List TimeCreated, Id, Message

Phase 2: Immediate Containment & Host Isolation#

  1. Network Isolation of the Weaponized Host: Immediately sever network connectivity for the workstation or server identified in the IpAddress field of the anomalous Event ID 4769.
  2. Disable the Compromised User Account: Disable the user account whose identity was leveraged to generate the initial TGT:
POWERSHELL 
Disable-ADAccount -Identity $SuspectUser
Revoke-ADUserSessions -Identity $SuspectUser -ErrorAction SilentlyContinue
  1. Purge Kerberos Ticket Cache on All Domain Controllers: Purge cached tickets on all Domain Controllers to force re-evaluation of tickets:
CMD 
:: Purge local system Kerberos ticket cache
klist -li 0x3e7 purge

Phase 3: Eradication via Controlled Double-KRBTGT Rotation#

To invalidate all active forged Diamond Tickets, execute the Microsoft-recommended double-rotation procedure:

  1. Execute First KRBTGT Password Reset: Utilize the official Microsoft New-KrbtgtKeys.ps1 script or native PowerShell:
POWERSHELL 
# Step 1: Execute initial KRBTGT password rotation
Set-ADAccountPassword -Identity "krbtgt" -NewPassword (ConvertTo-SecureString (New-Guid).Guid -AsPlainText -Force) -Reset
Write-Host "[+] Initial KRBTGT password reset completed. Replicating changes forest-wide..." -ForegroundColor Yellow

# Force replication across all Domain Controllers
repadmin /syncall /AdeP
  1. Enforce the Mandatory 10-12 Hour Replication Hold: Monitor the domain and verify that legitimate user sessions renew their tickets naturally under the new current key.
  2. Execute Second KRBTGT Password Reset: After the hold period concludes, execute the second password reset to permanently purge the compromised key from krbtgt_history:
POWERSHELL 
# Step 2: Execute secondary KRBTGT password rotation
Set-ADAccountPassword -Identity "krbtgt" -NewPassword (ConvertTo-SecureString (New-Guid).Guid -AsPlainText -Force) -Reset
Write-Host "[+] Secondary KRBTGT password reset completed. Forged keys permanently purged." -ForegroundColor Green

# Force final replication
repadmin /syncall /AdeP

Phase 4: Post-Remediation Verification & Hardening Checklist#

Before concluding incident response and returning the environment to standard operations, verify each checkpoint:

  • Confirm that PacSignatures is configured to 2 (Full Enforcement Mode) across all Domain Controllers.
  • Verify that all Domain Controllers have completed forest-wide replication following the second krbtgt reset:
CMD 
repadmin /replsummary
  • Confirm that zero PAC signature error events (Event ID 37-40) are actively firing on any Domain Controller.
  • Verify that all Tier-0 administrative accounts are enrolled in the Protected Users security group.
  • Deploy the production Sigma rule 7c94b62d-98e3-4f1b-a563-3e7215e9821a into your SIEM pipeline.
  • Validate that inbound RPC and SMB access to Domain Controllers is strictly restricted to designated administrative jump hosts.

Executive Takeaway Table#

Attack Vector / Phase Forensic Detection Signal Primary Defensive Mitigation
Initial TGT Acquisition (AS-REQ) Authentic Event ID 4768 with valid user SID, normal 10-hour lifetime, and AES-256 ciphers. Restrict compromised accounts; enroll privileged users in Protected Users group to enforce 4-hour ticket limits.
Offline PAC Tampering (MS-PAC) Zero host telemetry on Domain Controller; modification occurs offline using stolen krbtgt key. Prevent credential dumping (DCSync, LSASS scraping) via Tier-0 isolation and restricted RPC firewall policies.
PAC Checksum Calculation System Event Log Event ID 37 or 38 on DC if signatures fail verification under CVE-2022-37967. Set PacSignatures = 2 on Domain Controllers; enforce CVE-2022-37967 / KB5020805 Full Enforcement Mode.
Elevated Service Request (TGS-REQ) Event ID 4769 requesting privileged services (cifs/, ldap/) with group SIDs mismatched from AD database. Deploy behavioral SIEM correlation linking Event 4769 requested SIDs against actual Active Directory group membership.
Persistent Domain Exploitation Continued generation of unauthorized service tickets without authentication credential prompts. Execute controlled Double-KRBTGT Password Rotation with a mandatory 10-12 hour replication delay.

Authoritative References#

  1. Microsoft Security Guidance KB5020805: How to manage Kerberos protocol changes related to CVE-2022-37967 — Microsoft Support
  2. Microsoft Open Specifications: [MS-PAC]: Privilege Attribute Certificate Data Structure — Microsoft Learn
  3. Microsoft Open Specifications: [MS-KILE]: Kerberos Protocol Extensions — Microsoft Learn
  4. Semperis Research: A Diamond Ticket in the Ruff: Exploring Kerberos Diamond Ticket Attacks by Charlie Clark — Semperis Security Research
  5. Cybersecurity and Infrastructure Security Agency (CISA): Best Practices for Securing Active Directory Domain Controllers — CISA Advisory

Comments

Post a Comment

Drag or use arrow keys to pan • Click outside or press Esc to close