Kerberos serves as the invisible backbone of security within almost every modern corporate network. Being platform-independent, it is ubiquitous. If you log in to a computer at a company, school, or government agency, there is a near-100% chance that Kerberos is verifying your identity in the background.


Although the cryptography underlying Kerberos is robust, hackers rarely crack the protocol itself. Instead, they exploit human error, weak passwords, or the way computers store tickets in memory.


A hacker who has already gained access via a standard network account requests a service ticket for a server or application. Since this appears to be a legitimate request, Kerberos issues the ticket. The hacker steals this encrypted ticket and attempts to crack it offline using powerful computers; if the server’s password is weak, the service account’s password is compromised.


When you log in, your computer temporarily stores the Kerberos ticket (the TGT) in memory (LSASS) so you do not have to log in repeatedly. If a hacker compromises your computer with malware, they can copy this valid ticket directly from memory. They then transfer it to their own machine, gaining immediate network access without ever needing to know your password.


If a hacker manages to obtain the master key of the central Kerberos server (the KDC), they can create a “Golden Ticket.” By forging these tickets, they gain permanent access to every computer and all data within the organization.


With Fryqua, we monitor Kerberos anomalies in real time, such as:

    • A sudden, sustained spike in ticket requests from a single computer within a few seconds
    • Unexpected use of a fake service account
    • Use of a ticket from a computer other than the expected one
    • TGS requests to the KDC without a valid TGT
    • A login using a name not recognized in Active Directory, which could indicate a forged Golden Ticket

Curious about how we detect Kerberos anomalies in your IT environments? Let us show you how it works in a demo.