Kerberos is a network authentication protocol that uses encrypted tickets issued by a trusted server, so users can prove their identity to services without sending passwords over the network.
How Kerberos works
Kerberos was developed at MIT in the 1980s; version 5 is specified in RFC 4120 and is the default authentication protocol in Windows Active Directory. A trusted Key Distribution Center (KDC), which in Windows runs on every domain controller, issues two kinds of tickets:
- Ticket-granting ticket (TGT) – received after the user logs in, encrypted with the key of the special krbtgt account.
- Service tickets – requested with the TGT for each service (file share, SQL server, web app) and encrypted with that service account’s key.
Tickets have limited lifetimes and contain timestamps, which protects against replay attacks. Kerberos usually runs on port 88.
Why Kerberos matters for security
Because Kerberos is the backbone of corporate authentication, attackers target it after the initial compromise. MITRE ATT&CK lists several techniques under T1558 (Steal or Forge Kerberos Tickets):
- Kerberoasting (T1558.003) – requesting service tickets and cracking the service account passwords offline.
- AS-REP roasting (T1558.004) – targeting accounts that do not require pre-authentication.
- Golden Ticket (T1558.001) – forging any TGT with a stolen krbtgt hash, giving full domain control.
- Silver Ticket (T1558.002) – forging service tickets for a single service.
Pass-the-ticket attacks reuse stolen tickets for lateral movement.
How to secure Kerberos
- Use long, random passwords or managed service accounts (gMSA) for service accounts.
- Disable RC4 and require AES encryption for tickets.
- Reset the krbtgt password twice after a suspected domain compromise.
- Monitor unusual ticket requests, such as many service tickets from one user.
