Active Directory Kerberoasting Attack: Monitoring and Detection Techniques
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21240%2F20%3A00341139" target="_blank" >RIV/68407700:21240/20:00341139 - isvavai.cz</a>
Result on the web
<a href="https://www.insticc.org/node/TechnicalProgram/icissp/2020/presentationDetails/89550" target="_blank" >https://www.insticc.org/node/TechnicalProgram/icissp/2020/presentationDetails/89550</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.5220/0008955004320439" target="_blank" >10.5220/0008955004320439</a>
Alternative languages
Result language
angličtina
Original language name
Active Directory Kerberoasting Attack: Monitoring and Detection Techniques
Original language description
The paper focus is the detection of Kerberoasting attack in Active Directory environment. The purpose of the attack is to extract service accounts’ passwords without need for any special user access rights or privilege escalation, which makes it suitable for initial phases of network compromise and further pivot for more interesting accounts. The main goal of the paper is to discuss the monitoring possibilities, setting up detection rules built on top of native Active Directory auditing capabilities, including possible ways to minimize false positive alerts.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Result continuities
Project
<a href="/en/project/EF16_019%2F0000765" target="_blank" >EF16_019/0000765: Research Center for Informatics</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)
Others
Publication year
2020
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
Proceedings of the 6th International Conference on Information Systems Security and Privacy
ISBN
978-989-758-399-5
ISSN
2184-4356
e-ISSN
—
Number of pages
8
Pages from-to
432-439
Publisher name
SciTePress
Place of publication
Madeira
Event location
Valletta
Event date
Feb 25, 2020
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
000570766300044