Skip to content
The Incident Ledger

Kerberos

noun · RFC 4120

The ticket-based authentication protocol used by Active Directory, in which a domain controller issues tickets that prove a user's identity to services.

Kerberos lets users prove who they are to network services without sending their password across the network. In Active Directory, every domain controller runs a Key Distribution Center (KDC), and authentication happens in two steps:

  1. When the user signs in, the KDC checks their credentials and issues a ticket-granting ticket (TGT), encrypted with the key of a special account called krbtgt.
  2. When the user wants to reach a service, such as a file share or SQL server, they present the TGT and receive a service ticket for that specific service, encrypted with the service account's key.

The service trusts the ticket because only the KDC and the service know the key used to encrypt it. Tickets expire, typically after about ten hours for a TGT in a default Active Directory configuration.

Example

A user opens a file share. Their workstation silently asks a domain controller for a service ticket for that server, receives it and presents it to the file server, which grants access without ever seeing the user's password. On the domain controller, Windows records event 4768 for the TGT request at sign-in and event 4769 for the service ticket.

Why it matters for a SOC analyst

Several of the most damaging Active Directory attacks abuse Kerberos itself: Kerberoasting, golden and silver tickets, pass-the-ticket. Understanding the normal flow, and events 4768, 4769 and 4771 (pre-authentication failed), is what lets you recognize those attacks in domain controller logs.

Related terms

  • Domain controller

    A Windows server running Active Directory Domain Services: it stores accounts and password hashes and authenticates every sign-in in the domain.

  • Kerberoasting

    Requesting Kerberos service tickets for service accounts and cracking them offline to recover those accounts' passwords.

  • Golden ticket

    A forged Kerberos ticket-granting ticket, made with the krbtgt account's key, that lets an attacker impersonate any user in the domain.

  • NTLM

    An older Windows challenge-response authentication protocol, still used as a fallback to Kerberos and a frequent target of relay and pass-the-hash attacks.