WARNING<\/mark><\/strong> : The configurations mentioned here are only applicable to a lab environment as they can produce a very big amount of logs and thus can be difficult to analyze a in real scenario. They should be heavily modified to be usable in a production environment.<\/p><\/blockquote><\/figure>\n\n\n\nDomain controller<\/h3>\n\n\n\n In order to enable the correct Active Directory logs, some configuration is necessary as they are not enabled by default.<\/p>\n\n\n\n
First of all, you need to activate the advanced auditing policy. To do this, in an administrator command prompt, type gpmc.msc, which will open the following window:<\/p>\n\n\n\nThen go to Group Policy Management -> Forest: -> Domains -> -> Domain Controllers and right-click on Default Domain Controllers Policy, then click on Edit:<\/p>\n\n\n\nIt will open the following window:<\/p>\n\n\n\nThen go to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies:<\/p>\n\n\n\nIn Account Logon, set all options to Success and Failure:<\/p>\n\n\n\nSame for DS Access:<\/p>\n\n\n\nThe next step is to modify the registry. In HKLM\\SYSTEM\\CurrentControlSet\\ServicesNTDS\\Diagnostics\\, change the key 15 Field Engineering to 5 (verbose):<\/p>\n\n\n\nThen in HKLM\\SYSTEM\\CurrentControlSet\\ServicesNT\\Parameters\\, add the following DWORDs:<\/p>\n\n\n\n
\n\u00abExpensive Search Results Threshold\u00bb to 1<\/li>\n\n\n\n \u00abInefficient Search Results Threshold\u00bb to 1<\/li>\n\n\n\n \u00abSearch Time Threshold (msecs)\u00bb to 1<\/li>\n<\/ul>\n\n\n\nSysmon<\/h3>\n\n\n\nHere is the Sysmon configuration used in our lab:<\/summary>\n * False False Sysmon AcroRd32.exe \/CR;channel= C:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF\\AcroCEF.exe C:\\Program Files (x86)\\Common Files\\Adobe\\AdobeGCClient\\AGSService.exe C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe C:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\LogTransport2.exe C:\\Program Files (x86)\\Adobe\\Adobe Creative Cloud\\ACC\\Creative Cloud.exe C:\\Program Files (x86)\\Adobe\\Adobe Creative Cloud\\ACC\\Creative Cloud.exe C:\\Program Files (x86)\\Adobe\\Adobe Creative Cloud\\CCXProcess\\CCXProcess.exe C:\\Program Files (x86)\\Adobe\\Adobe Creative Cloud\\CoreSync\\CoreSync.exe C:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashPlayerUpdateService.exe C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\armsvc.exe C:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\AdobeCollabSync.exe C:\\Program Files (x86)\\Common Files\\Adobe\\Adobe Desktop Common\\HEX\\Adobe CEF Helper.exe C:\\Program Files (x86)\\Common Files\\Adobe\\AdobeGCClient\\AdobeGCClient.exe C:\\Program Files (x86)\\Common Files\\Adobe\\OOBE\\PDApp\\P6\\adobe_licutil.exe C:\\Program Files (x86)\\Common Files\\Adobe\\OOBE\\PDApp\\P7\\adobe_licutil.exe C:\\Program Files (x86)\\Common Files\\Adobe\\OOBE\\PDApp\\P7\\adobe_licutil.exe C:\\Program Files (x86)\\Common Files\\Adobe\\OOBE\\PDApp\\UWA\\updaterstartuputility.exe C:\\Program Files (x86)\\Common Files\\Adobe\\OOBE\\PDApp\\UWA\\updaterstartuputility.exe "C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe" -Embedding "C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe" C:\\Windows\\system32\\cscript.exe" \/nologo "MonitorKnowledgeDiscovery.vbs C:\\Program Files (x86)\\Cisco\\Cisco AnyConnect Secure Mobility Client\\vpnagent.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.exe C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe C:\\Windows\\Microsoft.Net\\Framework64\\v3.0\\WPF\\PresentationFontCache.exe C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngentask.exe C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ngentask.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngentask.exe C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\ngentask.exe C:\\Program Files\\NVIDIA Corporation\\ C:\\Program Files\\Realtek\\ C:\\Program Files\\Realtek\\Audio\\HDA\\RtkAudioService64.exe C:\\Program Files (x86)\\Dropbox\\Update\\DropboxUpdate.exe C:\\Program Files (x86)\\Dropbox\\Update\\DropboxUpdate.exe C:\\Program Files\\ESET\\ESET Nod32 Antivirus\\ekrn.exe "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe" --type= "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --type= C:\\Program Files (x86)\\Google\\Update\\ C:\\Program Files (x86)\\Google\\Update\\ C:\\Program Files (x86)\\RES Software\\Workspace Manager\\pfwsmgr.exe C:\\Program Files (x86)\\RES Software\\Workspace Manager\\respesvc64.exe C:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe C:\\Program Files (x86)\\RES Software\\Workspace Manager\\ResPesvc64.exe C:\\Program Files\\RES Software\\Workspace Manager\\respesvc.exe C:\\Program Files\\Ivanti\\Workspace Control\\ResPesvc.exe C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbam.exe C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamtray.exe C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe C:\\Program Files (x86)\\Microsoft Office\\Office16\\MSOSYNC.EXE C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE "C:\\Program Files\\Mozilla Firefox\\plugin-container.exe" --channel "C:\\Program Files (x86)\\Mozilla Firefox\\plugin-container.exe" --channel C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive;\\FileCoAuth.exe C:\\Program Files (x86)\\Sophos\\Sophos Anti-Virus\\Web Intelligence\\swi_service.exe C:\\Program Files (x86)\\Sophos\\Sophos Anti-Virus\\Web Control\\swc_service.exe C:\\Program Files (x86)\\Sophos\\Sophos System Protection\\ssp.exe C:\\Program Files (x86)\\Sophos\\Remote Management System\\RouterNT.exe C:\\Program Files (x86)\\Sophos\\AutoUpdate\\ALsvc.exe C:\\Program Files (x86)\\Sophos\\Sophos Anti-Virus\\SAVAdminService.exe C:\\Program Files (x86)\\Sophos\\Remote Management System\\ManagementAgentNT.exe C:\\Program Files\\Splunk\\bin\\ C:\\Program Files\\Splunk\\bin\\splunkd.exe C:\\Program Files\\Splunk\\bin\\splunk.exe D:\\Program Files\\Splunk\\bin\\ D:\\Program Files\\Splunk\\bin\\splunkd.exe D:\\Program Files\\Splunk\\bin\\splunk.exe C:\\Program Files\\SplunkUniversalForwarder\\bin\\ C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe C:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe D:\\Program Files\\SplunkUniversalForwarder\\bin\\ D:\\Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe D:\\Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe C:\\Windows\\system32\\svchost.exe -k appmodel -s StateRepository C:\\Windows\\system32\\svchost.exe -k appmodel C:\\WINDOWS\\system32\\svchost.exe -k appmodel -p -s tiledatamodelsvc C:\\Windows\\system32\\svchost.exe -k camera -s FrameServer C:\\Windows\\system32\\svchost.exe -k dcomlaunch -s LSM C:\\Windows\\system32\\svchost.exe -k dcomlaunch -s PlugPlay C:\\Windows\\system32\\svchost.exe -k defragsvc C:\\Windows\\system32\\svchost.exe -k devicesflow -s DevicesFlowUserSvc C:\\Windows\\system32\\svchost.exe -k imgsvc C:\\Windows\\system32\\svchost.exe -k localService -s EventSystem C:\\Windows\\system32\\svchost.exe -k localService -s bthserv C:\\Windows\\system32\\svchost.exe -k localService -s nsi C:\\Windows\\system32\\svchost.exe -k localService -s w32Time C:\\Windows\\system32\\svchost.exe -k localServiceAndNoImpersonation C:\\Windows\\system32\\svchost.exe -k localServiceNetworkRestricted -s Dhcp C:\\Windows\\system32\\svchost.exe -k localServiceNetworkRestricted -s EventLog C:\\Windows\\system32\\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc C:\\Windows\\system32\\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc C:\\Windows\\system32\\svchost.exe -k localServiceNetworkRestricted C:\\Windows\\system32\\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc C:\\Windows\\system32\\svchost.exe -k localServiceNoNetwork C:\\Windows\\system32\\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum C:\\Windows\\system32\\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc C:\\Windows\\system32\\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService C:\\Windows\\system32\\svchost.exe -k localSystemNetworkRestricted -s NcbService C:\\Windows\\system32\\svchost.exe -k localSystemNetworkRestricted -s SensorService C:\\Windows\\system32\\svchost.exe -k localSystemNetworkRestricted -s TabletInputService C:\\Windows\\system32\\svchost.exe -k localSystemNetworkRestricted -s UmRdpService C:\\Windows\\system32\\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum C:\\Windows\\system32\\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost C:\\WINDOWS\\System32\\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost C:\\Windows\\system32\\svchost.exe -k localSystemNetworkRestricted C:\\WINDOWS\\system32\\svchost.exe -k netsvcs -p -s wlidsvc C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s ncaSvc C:\\Windows\\system32\\svchost.exe -k netsvcs -s BDESVC C:\\Windows\\system32\\svchost.exe -k netsvcs -s BITS C:\\Windows\\system32\\svchost.exe -k netsvcs -s CertPropSvc C:\\Windows\\system32\\svchost.exe -k netsvcs -s DsmSvc C:\\Windows\\system32\\svchost.exe -k netsvcs -s Gpsvc C:\\Windows\\system32\\svchost.exe -k netsvcs -s ProfSvc C:\\Windows\\system32\\svchost.exe -k netsvcs -s SENS C:\\Windows\\system32\\svchost.exe -k netsvcs -s SessionEnv C:\\Windows\\system32\\svchost.exe -k netsvcs -s Themes C:\\Windows\\system32\\svchost.exe -k netsvcs -s Winmgmt C:\\Windows\\system32\\svchost.exe -k netsvcs C:\\Windows\\system32\\svchost.exe -k networkService -p -s DoSvc C:\\Windows\\system32\\svchost.exe -k networkService -s Dnscache C:\\Windows\\system32\\svchost.exe -k networkService -s LanmanWorkstation C:\\Windows\\system32\\svchost.exe -k networkService -s NlaSvc C:\\Windows\\system32\\svchost.exe -k networkService -s TermService C:\\Windows\\system32\\svchost.exe -k networkService C:\\Windows\\system32\\svchost.exe -k networkServiceNetworkRestricted C:\\Windows\\system32\\svchost.exe -k rPCSS C:\\Windows\\system32\\svchost.exe -k secsvcs C:\\Windows\\system32\\svchost.exe -k swprv C:\\Windows\\system32\\svchost.exe -k unistackSvcGroup C:\\Windows\\system32\\svchost.exe -k utcsvc C:\\Windows\\system32\\svchost.exe -k wbioSvcGroup C:\\Windows\\system32\\svchost.exe -k werSvcGroup C:\\WINDOWS\\System32\\svchost.exe -k wsappx -p -s ClipSVC C:\\WINDOWS\\system32\\svchost.exe -k wsappx -p -s AppXSvc C:\\Windows\\system32\\svchost.exe -k wsappx -s ClipSVC C:\\Windows\\system32\\svchost.exe -k wsappx C:\\Windows\\system32\\svchost.exe -k netsvcs C:\\Windows\\system32\\svchost.exe -k localSystemNetworkRestricted C:\\Program Files\\Trend Micro\\Deep Security Agent\\ds_monitor.exe C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsa.exe C:\\Program Files\\Trend Micro\\Deep Security Agent\\dsuam.exe C:\\Program Files\\Trend Micro\\Deep Security Agent\\Notifier.exe C:\\Program Files\\Trend Micro\\Deep Security Agent\\lib\\Patch.exe C:\\Program Files (x86)\\Trend Micro\\BM\\TMBMSRV.exe C:\\Program Files (x86)\\Trend Micro\\OfficeScan Client\\TmopExtIns32.exe C:\\Program Files (x86)\\Trend Micro\\OfficeScan Client\\TmExtIns.exe C:\\Program Files (x86)\\Trend Micro\\OfficeScan Client\\TmListen.exe C:\\Program Files\\Windows Defender\\ C:\\Windows\\system32\\MpSigStub.exe C:\\Windows\\SoftwareDistribution\\Download\\Install\\AM_ C:\\Program Files\\Microsoft Security Client\\MpCmdRun.exe C:\\Windows\\system32\\DllHost.exe \/Processid C:\\Windows\\system32\\SearchIndexer.exe \/Embedding C:\\Windows\\System32\\CompatTelRunner.exe C:\\Windows\\System32\\MusNotification.exe C:\\Windows\\System32\\MusNotificationUx.exe C:\\Windows\\System32\\audiodg.exe C:\\Windows\\System32\\conhost.exe C:\\Windows\\System32\\powercfg.exe C:\\Windows\\System32\\wbem\\WmiApSrv.exe C:\\Windows\\System32\\wermgr.exe C:\\Windows\\SysWOW64\\wermgr.exe C:\\Windows\\system32\\sppsvc.exe AppContainer %%SystemRoot%%\\system32\\csrss.exe ObjectDirectory=\\Windows C:\\Windows\\system32\\SearchIndexer.exe AppData\\Local\\Google\\Chrome\\Application\\chrome.exe Root\\VFS\\ProgramFilesX86\\Google\\Chrome\\Application\\chrome.exe OneDrive.exe setup slack.exe AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe AppData\\Roaming\\Dropbox\\bin\\Dropbox.exe winlogbeat.exe packetbeat.exe C:\\Program Files\\ESET\\ESET Nod32 Antivirus\\ekrn.exe OneDrive.exe OneDriveStandaloneUpdater.exe ownCloud\\owncloud.exe C:\\Program Files\\Palo Alto Networks\\Traps\\cyserver.exe udp 3389 C:\\Program Files (x86)\\Sophos\\Sophos Anti-Virus\\Web Intelligence\\swi_service.exe C:\\Program Files (x86)\\Sophos\\AutoUpdate\\ALsvc.exe C:\\Program Files (x86)\\Sophos\\Remote Management System\\RouterNT.exe C:\\Program Files (x86)\\Sophos\\Sophos Anti-Virus\\Web Control\\swc_service.exe C:\\Program Files (x86)\\Sophos\\Sophos Anti-Virus\\Web Intelligence\\swi_service.exe C:\\Program Files\\Sophos\\Sophos Network Threat Protection\\bin\\SntpService.exe AppData\\Roaming\\Spotify\\Spotify.exe AppData\\Local\\SynologyDrive\\SynologyDrive.app\\bin\\cloud-drive-ui.exe AppData\\Local\\SynologyDrive\\SynologyDrive.app\\bin\\cloud-drive-daemon.exe C:\\Program files (x86)\\Trend Micro\\OfficeScan Client\\tmlisten.exe C:\\Program Files (x86)\\Trend Micro\\BM\\TMBMSRV.exe .windowsupdate.microsoft.com .windowsupdate.com wustat.windows.com go.microsoft.com .update.microsoft.com download.microsoft.com microsoft.com.akadns.net microsoft.com.nsatc.net Intel Valid Microsoft Valid C:\\Windows\\System32\\cscript.exe scrobj.dll VSTOInstaller.exe C:\\Windows\\ C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive;\\FileCoAuth.exe C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive\\;\\FileSyncTelemetryExtensions.dll C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive;\\FileCoAuth.exe C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive\\;\\FileCoAuthLib.dll C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive;\\FileCoAuth.exe C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive\\;\\OneDriveTelemetryStable.dll C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive;\\FileCoAuth.exe C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive\\;\\vcruntime140.dll C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive;\\FileCoAuth.exe C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive\\;\\UpdateRingSettings.dll C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive;\\FileCoAuth.exe C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive\\;\\LoggingPlatform.dll C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive;\\FileCoAuth.exe C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive\\;\\FileCoAuth.exe C:\\Windows\\System32\\svchost.exe C:\\Windows\\System32\\wininit.exe C:\\Windows\\System32\\csrss.exe C:\\Windows\\System32\\services.exe C:\\Windows\\System32\\winlogon.exe C:\\Windows\\System32\\audiodg.exe C:\\Windows\\System32\\dwm.exe C:\\Windows\\System32\\csrss.exe Google\\Chrome\\Application\\chrome.exe C:\\Windows\\System32\\wbem\\WmiPrvSE.exe C:\\Program Files\\Adobe\\Adobe Creative Cloud Experience\\libs\\node.exe C:\\Program Files;\\Common Files\\Adobe\\AdobeGCClient\\AGMService.exe C:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe C:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF\\AcroCEF.exe C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARMHelper.exe C:\\Program Files\\Adobe\\Adobe Photoshop 2021\\Photoshop.exe C:\\Program Files\\Autodesk\\Autodesk Desktop App C:\\Program Files (x86)\\Autodesk\\Autodesk Desktop App C:\\Windows\\CarbonBlack\\cb.exe C:\\Program Files\\Cisco\\AMP\\;sfc.exe C:\\Users\\;\\AppData\\Local\\Citrix\\ICA Client\\receiver\\Receiver.exe C:\\Program Files (x86)\\Citrix\\ICA Client\\Receiver\\Receiver.exe c:\\Program Files\\Couchbase\\Server\\bin\\sigar_port.exe C:\\Program Files;\\FireEye\\xagt\\xagt.exe C:\\Program Files (x86)\\Ivanti\\Workspace Control\\cpushld.exe C:\\Program Files (x86)\\RES Software\\Workspace Manager\\cpushld.exe C:\\Program Files\\Ivanti\\Workspace Control\\cpushld.exe C:\\Program Files\\RES Software\\Workspace Manager\\cpushld.exe wmiprvse.exe GoogleUpdate.exe LTSVC.exe taskmgr.exe VBoxService.exe vmtoolsd.exe Citrix\\System32\\wfshell.exe C:\\Windows\\System32\\lsm.exe Microsoft.Identity.AadConnect.Health.AadSync.Host.exe C:\\Program Files (x86)\\Symantec\\Symantec Endpoint Protection 0x1000 0x1400 0x101400 0x101000 C:\\Program Files\\McAfee\\Endpoint Security\\Endpoint Security Platform\\mfeesp.exe C:\\Program Files\\McAfee\\Agent\\x86\\macompatsvc.exe C:\\Users\\;\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLOOK.EXE C:\\Program Files\\PowerToys\\modules\\KeyboardManager\\KeyboardManagerEngine\\PowerToys.KeyboardManagerEngine.exe C:\\Users\\;\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe C:\\Users\\;\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe C:\\Program Files\\Microsoft Security Client\\MsMpEng.exe C:\\Program Files\\Windows Defender\\MsMpEng.exe C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\;\\MsMpEng.exe C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaXterm.exe C:\\Program Files\\Palo Alto Networks\\Traps\\cyserver.exe C:\\Program Files\\Qualys\\QualysAgent\\QualysAgent.exe C:\\Program Files (x86)\\Razer Chroma SDK\\bin\\RzSDKService.exe C:\\WINDOWS\\CCM\\CcmExec.exe C:\\Program Files\\Splunk\\bin\\splunkd.exe C:\\Program Files (x86)\\VMware\\VMWare Player\\vmware-authd.exe C:\\Program Files (x86)\\VMware\\VMware Workstation\\vmware-authd.exe C:\\Program Files\\WinZip\\FAHWindow64.exe C:\\Program Files (x86)\\Dell\\CommandUpdate\\InvColPC.exe C:\\Windows\\system32\\igfxCUIService.exe C:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe C:\\Program Files (x86)\\RES Software\\Workspace Manager\\pfwsmgr.exe C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe C:\\Windows\\System32\\smss.exe C:\\Windows\\system32\\CompatTelRunner.exe C:\\Windows\\system32\\wbem\\WMIADAP.EXE C:\\Windows\\System32\\DriverStore\\Temp\\ C:\\Windows\\System32\\wbem\\Performance\\ WRITABLE.TST \\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ C:\\$WINDOWS.~BT\\Sources\\SafeOS\\SafeOS.Mount\\ C:\\WINDOWS\\winsxs\\amd64_microsoft-windows c:\\Program Files\\Microsoft Security Client\\MsMpEng.exe Outlook.exe Roaming\\Microsoft\\Outlook\\Outlook.xml c:\\windows\\system32\\provtool.exe C:\\WINDOWS\\CCM\\CcmExec.exe C:\\Windows\\CCM C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\PLA\\FabricTraces C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\SoftwareProtectionPlatform\\SvcRestartTask C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\Customer Experience Improvement Program\\Server\\ServerRoleUsageCollector C:\\Windows\\System32\\Tasks\\Microsoft\\Windows\\Customer Experience Improvement Program\\Server\\ServerCeipAssistant C:\\Program Files (x86)\\Cisco\\Cisco AnyConnect Secure Mobility Client\\aciseposture.exe C:\\Program Files (x86)\\Cisco\\Cisco AnyConnect Secure Mobility Client\\vpnagent.exe C:\\Program Files\\Cylance\\Optics\\CyOptics.exe C:\\Program Files\\Cylance\\Desktop\\CylanceSvc.exe Toolbar\\WebBrowser Toolbar\\WebBrowser\\ITBar7Height Toolbar\\ShellBrowser\\ITBar7Layout Internet Explorer\\Toolbar\\Locked ShellBrowser C:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe C:\\Program Files\\RES Software\\Workspace Manager\\pfwsmgr.exe C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Internet Security C:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security C:\\Program Files\\McAfee\\Endpoint Encryption Agent\\MfeEpeHost.exe C:\\Program Files\\McAfee\\Endpoint Security\\Adaptive Threat Protection\\mfeatp.exe C:\\Program Files\\McAfee\\Endpoint Security\\Endpoint Security Platform\\mfeesp.exe C:\\Program Files\\Common Files\\McAfee\\Engine\\AMCoreUpdater\\amupdate.exe C:\\Program Files\\McAfee\\Agent\\masvc.exe C:\\Program Files\\McAfee\\Agent\\x86\\mfemactl.exe C:\\Program Files\\McAfee\\Agent\\x86\\McScript_InUse.exe C:\\Program Files\\McAfee\\Agent\\x86\\macompatsvc.exe C:\\Program Files\\McAfee\\Endpoint Security\\Threat Prevention\\mfeensppl.exe C:\\Program Files\\Common Files\\McAfee\\Engine\\scanners C:\\Program Files\\Common Files\\McAfee\\AVSolution\\mcshield.exe C:\\Program Files\\ownCloud\\owncloud.exe C:\\Program Files (x86)\\ownCloud\\owncloud.exe svchost.exe HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks C:\\Program Files\\SentinelOne\\Sentinel Agent System C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe HKLM\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters C:\\Program Files (x86)\\Webroot\\WRSA.exe C:\\Program Files\\WIDCOMM\\Bluetooth Software\\btwdins.exe HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Audit HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Audit\\AuditPolicy HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Audit\\PerUserAuditing\\System HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\SspiCache HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos\\Domains HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit OpenWithProgids OpenWithList \\UserChoice \\UserChoice\\ProgId \\UserChoice\\Hash \\OpenWithList\\MRUList } 0xFFFF Office\\root\\integration\\integrator.exe C:\\WINDOWS\\system32\\backgroundTaskHost.exe C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeClickToRun.exe C:\\Program Files\\Windows Defender\\MsMpEng.exe C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe C:\\Program Files\\Microsoft Application Virtualization\\Client\\AppVClient.exe \\CurrentVersion\\App Paths \\CurrentVersion\\Image File Execution Options \\CurrentVersion\\Shell Extensions\\Cached \\CurrentVersion\\Shell Extensions\\Approved }\\PreviousPolicyAreas \\Control\\WMI\\Autologger\\ HKLM\\SYSTEM\\CurrentControlSet\\Services\\UsoSvc\\Start \\Lsa\\OfflineJoin\\CurrentValue \\Components\\TrustedInstaller\\Events Components\\TrustedInstaller \\Components\\Wlansvc \\Components\\Wlansvc\\Events HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\ \\Directory\\shellex \\Directory\\shellex\\DragDropHandlers \\Drive\\shellex \\Drive\\shellex\\DragDropHandlers _Classes\\AppX HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Publishers\\ HKLM\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates C:\\Windows\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\SearchUI.exe C:\\$WINDOWS.~BT\\ HKLM\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters C:\\Windows\\system32\\lsass.exe HKLM\\System\\CurrentControlSet\\Services \\services\\clr_optimization_v2.0.50727_32\\Start \\services\\clr_optimization_v2.0.50727_64\\Start \\services\\clr_optimization_v4.0.30319_32\\Start \\services\\clr_optimization_v4.0.30319_64\\Start \\services\\DeviceAssociationService\\Start \\services\\BITS\\Start \\services\\TrustedInstaller\\Start \\services\\tunnel\\Start \\services\\UsoSvc\\Start C:\\Program Files;\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe \\32B6B37A-4A7D-4e00-95F2- thsnYaVieBoda C:\\Program Files;\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe \\com.adobe.reader.rna.;\\mojo C:\\Program Files;\\Common Files\\Adobe\\AdobeGCClient\\AGMService.exe \\gc_pipe_ C:\\Program Files;\\Common Files\\Adobe\\Creative Cloud Libraries\\libs\\node.exe \\uv\\ "C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe" C:\\Users\\;\\AppData\\Local\\Programs\\Call Manager\\Call Manager.exe \\crashpad_;\\mojo.;\\uv\\ C:\\Program Files;\\Citrix\\ICA Client\\SelfServicePlugin\\SelfService.exe C:\\Program Files;\\Citrix\\ICA Client\\Receiver\\Receiver.exe C:\\Program Files;\\Citrix\\ICA Client\\wfcrun32.exe C:\\Program Files;\\Citrix\\ICA Client\\concentr.exe C:\\Users\\;\\AppData\\Local\\Citrix\\ICA Client\\receiver\\Receiver.exe C:\\Users\\;\\AppData\\Local\\Citrix\\ICA Client\\SelfServicePlugin\\SelfService.exe C:\\Program Files;\\FireEye\\xagt\\xagt.exe C:\\Program Files;\\Google\\Update\\Install\\;setup.exe \\crashpad_ C:\\Program Files;\\Google\\Chrome\\Application\\chrome.exe \\mojo. C:\\Program Files;\\Google\\Chrome\\Application\\;\\Installer\\chrmstp.exe \\crashpad_ Vivisimo Velocity C:\\Program Files;\\Microsoft\\Edge\\Application\\msedge.exe \\LOCAL\\mojo. C:\\Program Files;\\Microsoft\\Edge\\Application\\msedge.exe \\LOCAL\\chrome.sync. C:\\Program Files;\\Microsoft\\Edge\\Application\\msedge.exe \\LOCAL\\crashpad_ C:\\Program Files;\\Microsoft Office\\root\\Office16\\OUTLOOK.EXE \\MsFteWds C:\\Users\\;\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe \\mojo. C:\\Users\\;\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe \\chrome.sync. C:\\Program Files;\\Mozilla Firefox\\firefox.exe \\cubeb-pipe- C:\\Program Files;\\Mozilla Firefox\\firefox.exe \\chromium. C:\\Program Files;\\Mozilla Firefox\\firefox.exe \\gecko-crash-server-pipe. \\SQLLocal\\MSSQLSERVER \\SQLLocal\\INSTANCE01 \\SQLLocal\\SQLEXPRESS \\SQLLocal\\COMMVAULT \\SQLLocal\\RTCLOCAL \\SQLLocal\\RTC \\SQLLocal\\TMSM Program Files (x86)\\Microsoft SQL Server\\110\\DTS\\binn\\dtexec.exe PostgreSQL\\9.6\\bin\\postgres.exe \\pgsignal_ Program Files\\Qlik\\Sense\\Engine\\Engine.exe C:\\Program Files;\\Qualys\\QualysAgent\\QualysAgent.exe Program Files\\SplunkUniversalForwarder\\bin\\splunkd.exe Program Files\\SplunkUniversalForwarder\\bin\\splunk.exe Program Files\\SplunkUniversalForwarder\\bin\\splunk-MonitorNoHandle.exe Program Files (x86)\\Trend Micro\\OfficeScan\\PCCSRV\\CMAgent\\OfcCMAgent.exe Program Files (x86)\\Trend Micro\\OfficeScan\\PCCSRV\\web\\service\\ofcservice.exe Program Files (x86)\\Trend Micro\\OfficeScan\\PCCSRV\\Web\\Service\\DbServer.exe Program Files (x86)\\Trend Micro\\OfficeScan\\PCCSRV\\web\\service\\verconn.exe Program Files (x86)\\Trend Micro\\OfficeScan\\PCCSRV\\WEB_OSCE\\WEB\\CGI\\cgiOnClose.exe Program Files (x86)\\Trend Micro\\OfficeScan\\PCCSRV\\WEB_OSCE\\WEB\\CGI\\cgiRqHotFix.exe Program Files (x86)\\Trend Micro\\OfficeScan\\PCCSRV\\LWCS\\LWCSService.exe Program Files (x86)\\Trend Micro\\OfficeScan\\PCCSRV\\WSS\\iCRCService.exe Program Files\\Trend\\SPROTECT\\x64\\tsc.exe Program Files\\Trend\\SPROTECT\\x64\\tsc64.exe Program Files (x86)\\Trend Micro\\OfficeScan\\PCCSRV\\web\\service\\osceintegrationservice.exe Program Files (x86)\\Trend Micro\\OfficeScan\\PCCSRV\\web\\service\\OfcLogReceiverSvc.exe \\Trend Micro OSCE Command Handler Manager \\Trend Micro OSCE Command Handler2 Manager \\Trend Micro Endpoint Encryption ToolBox Command Handler Manager \\OfcServerNamePipe \\ntapvsrq \\srvsvc \\wkssvc \\lsass \\winreg \\spools Anonymous Pipe c:\\windows\\system32\\inetsrv\\w3wp.exe .1rx.io .2mdn.net .adadvisor.net .adap.tv .addthis.com .adform.net .adnxs.com .adroll.com .adrta.com .adsafeprotected.com .adsrvr.org .advertising.com .amazon-adsystem.com .amazon-adsystem.com .analytics.yahoo.com .aol.com .betrad.com .bidswitch.net .casalemedia.com .chartbeat.net .cnn.com .convertro.com .criteo.com .criteo.net .crwdcntrl.net .demdex.net .domdex.com .dotomi.com .doubleclick.net .doubleverify.com .emxdgt.com .exelator.com .google-analytics.com .googleadservices.com .googlesyndication.com .googletagmanager.com .googlevideo.com .gstatic.com .gvt1.com .gvt2.com ib-ibi.com .jivox.com .mathtag.com .moatads.com .moatpixel.com .mookie1.com .myvisualiq.net .netmng.com .nexac.com .openx.net .optimizely.com .outbrain.com .pardot.com .phx.gbl .pinterest.com .pubmatic.com .quantcount.com .quantserve.com .revsci.net rfihub.net .rlcdn.com .rubiconproject.com .scdn.co .scorecardresearch.com .serving-sys.com .sharethrough.com .simpli.fi .sitescout.com .smartadserver.com .snapads.com .spotxchange.com .taboola.com .taboola.map.fastly.net .tapad.com .tidaltv.com .trafficmanager.net .tremorhub.com .tribalfusion.com .turn.com .twimg.com .tynt.com .w55c.net .ytimg.com .zorosrv.com 1rx.io adservice.google.com ampcid.google.com clientservices.googleapis.com googleadapis.l.google.com imasdk.googleapis.com l.google.com ml314.com mtalk.google.com update.googleapis.com www.googletagservices.com .mozaws.net .mozilla.com .mozilla.net .mozilla.org clients1.google.com clients2.google.com clients3.google.com clients4.google.com clients5.google.com clients6.google.com safebrowsing.googleapis.com .akadns.net .netflix.com .aspnetcdn.com ajax.googleapis.com cdnjs.cloudflare.com fonts.googleapis.com .typekit.net cdnjs.cloudflare.com .stackassets.com .steamcontent.com .arpa. .arpa .msftncsi.com .localmachine localhost C:\\ProgramData\\LogiShrd\\LogiOptions\\Software\\Current\\updater.exe .logitech.com C:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe -pushp.svc.ms .b-msedge.net bing.com .hotmail.com .live.com .live.net .s-microsoft.com .microsoft.com .microsoftonline.com .microsoftstore.com .ms-acdc.office.com .msedge.net .msn.com .msocdn.com .skype.com .skype.net .windows.com .windows.net.nsatc.net .windowsupdate.com .xboxlive.com login.windows.net outlook.office.com statics.teams.cdn.office.net acdc-direct.office.com .fp.measure.office.com office365.com .activedirectory.windowsazure.com aria.microsoft.com .msauth.net .msftauth.net .opinsights.azure.com management.azure.com outlook.office365.com portal.azure.com substrate.office.com osi.office.net .digicert.com .globalsign.com .globalsign.net msocsp.com ocsp.msocsp.com pki.goog .pki.goog ocsp.godaddy.com amazontrust.com .amazontrust.com ocsp.sectigo.com pki-goog.l.google.com .usertrust.com ocsp.comodoca.com ocsp.verisign.com ocsp.entrust.net ocsp.identrust.com status.rapidssl.com status.thawte.com ocsp.int-x3.letsencrypt.org subca.ocsp-certum.com cscasha2.ocsp-certum.com crl.verisign.com C:\\Program Files\\SentinelOne\\Sentinel Agent;\\SentinelAgent.exe .spotify.com .spotify.map.fastly.net C:\\Windows\\SystemApps\\Microsoft.Windows.Search;SearchApp.exe \\appdata\\local\\google\\chrome\\user data\\swreporter\\;software_reporter_tool.exe C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe NETWORK SERVICE; SERVICE ROOM AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-Interactive C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe C:\\Program Files\\Mozilla Firefox\\firefox.exe C:\\Program Files\\Mozilla Firefox\\updater.exe C:\\Program Files\\Mozilla Firefox\\default-browser-agent.exe C:\\Program Files\\Mozilla Firefox\\pingsender.exe C:\\Program Files\\Git\\cmd\\git.exe C:\\Program Files\\Git\\mingw64\\bin\\git.exe C:\\Program Files\\Git\\mingw64\\libexec\\git-core\\git.exe C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\ \\BHO\\ie_to_edge_stub.exe C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\ identity_helper.exe C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\ Microsoft Edge x64 unknown process C:\\Program Files\\Microsoft VS Code\\Code.exe \\appdata\\local\\google\\chrome\\user data\\swreporter\\;software_reporter_tool.exe C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe NETWORK SERVICE; SERVICE ROOM<\/code><\/pre>\n\n\n\n<\/p>\n<\/details>","protected":false},"excerpt":{"rendered":"
We are starting a series of articles in which we share a summary of the [\u2026]<\/p>","protected":false},"author":41,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[186],"class_list":["post-227378","post","type-post","status-publish","format-standard","hentry","category-red-teaming","tag-red-team"],"yoast_head":"\n
Kerberos: Key OPSEC Tactics for Red & Blue Teams<\/title>\n<meta name=\"description\" content=\"Explore essential OPSEC practices for Red Teams and advanced detection strategies for Blue Teams, focusing on the Kerberos protocol\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/kerberos_opsec_introduction\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kerberos OPSEC: Offense & Detection Strategies for Red and Blue Team - Introduction\" \/>\n<meta property=\"og:description\" content=\"Explore essential OPSEC practices for Red Teams and advanced detection strategies for Blue Teams, focusing on the Kerberos protocol\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/kerberos_opsec_introduction\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2023-12-13T12:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-02-23T16:48:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image.png\" \/>\n\t<meta property=\"og:image:width\" content=\"751\" \/>\n\t<meta property=\"og:image:height\" content=\"225\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Pierre Livet\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pierre Livet\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/kerberos_opsec_introduction\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/kerberos_opsec_introduction\\\/\"},\"author\":{\"name\":\"Pierre Livet\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/8b3c61dad317a9965e5084f0da156e55\"},\"headline\":\"Kerberos OPSEC: Offense & Detection Strategies for Red and Blue Team – Introduction\",\"datePublished\":\"2023-12-13T12:00:00+00:00\",\"dateModified\":\"2026-02-23T16:48:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/kerberos_opsec_introduction\\\/\"},\"wordCount\":1331,\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/kerberos_opsec_introduction\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/image.png\",\"keywords\":[\"Red Team\"],\"articleSection\":[\"Red Teaming\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/kerberos_opsec_introduction\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/kerberos_opsec_introduction\\\/\",\"name\":\"Kerberos: Key OPSEC Tactics for Red & Blue Teams\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/kerberos_opsec_introduction\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/kerberos_opsec_introduction\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/image.png\",\"datePublished\":\"2023-12-13T12:00:00+00:00\",\"dateModified\":\"2026-02-23T16:48:29+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/8b3c61dad317a9965e5084f0da156e55\"},\"description\":\"Explore essential OPSEC practices for Red Teams and advanced detection strategies for Blue Teams, focusing on the Kerberos protocol\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/kerberos_opsec_introduction\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/kerberos_opsec_introduction\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/kerberos_opsec_introduction\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/image.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/image.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/kerberos_opsec_introduction\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kerberos OPSEC: Offense & Detection Strategies for Red and Blue Team – Introduction\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/8b3c61dad317a9965e5084f0da156e55\",\"name\":\"Pierre Livet\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=retro&r=g\",\"caption\":\"Pierre Livet\"},\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/pierre-livet\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Kerberos: Key OPSEC Tactics for Red & Blue Teams","description":"Explore essential OPSEC practices for Red Teams and advanced detection strategies for Blue Teams, focusing on the Kerberos protocol","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/kerberos_opsec_introduction\/","og_locale":"en_US","og_type":"article","og_title":"Kerberos OPSEC: Offense & Detection Strategies for Red and Blue Team - Introduction","og_description":"Explore essential OPSEC practices for Red Teams and advanced detection strategies for Blue Teams, focusing on the Kerberos protocol","og_url":"https:\/\/www.intrinsec.com\/en\/kerberos_opsec_introduction\/","og_site_name":"INTRINSEC","article_published_time":"2023-12-13T12:00:00+00:00","article_modified_time":"2026-02-23T16:48:29+00:00","og_image":[{"width":751,"height":225,"url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image.png","type":"image\/png"}],"author":"Pierre Livet","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Pierre Livet","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/kerberos_opsec_introduction\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/kerberos_opsec_introduction\/"},"author":{"name":"Pierre Livet","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/8b3c61dad317a9965e5084f0da156e55"},"headline":"Kerberos OPSEC: Offense & Detection Strategies for Red and Blue Team – Introduction","datePublished":"2023-12-13T12:00:00+00:00","dateModified":"2026-02-23T16:48:29+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/kerberos_opsec_introduction\/"},"wordCount":1331,"image":{"@id":"https:\/\/www.intrinsec.com\/kerberos_opsec_introduction\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image.png","keywords":["Red Team"],"articleSection":["Red Teaming"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/kerberos_opsec_introduction\/","url":"https:\/\/www.intrinsec.com\/kerberos_opsec_introduction\/","name":"Kerberos: Key OPSEC Tactics for Red & Blue Teams","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/kerberos_opsec_introduction\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/kerberos_opsec_introduction\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image.png","datePublished":"2023-12-13T12:00:00+00:00","dateModified":"2026-02-23T16:48:29+00:00","author":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/8b3c61dad317a9965e5084f0da156e55"},"description":"Explore essential OPSEC practices for Red Teams and advanced detection strategies for Blue Teams, focusing on the Kerberos protocol","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/kerberos_opsec_introduction\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/kerberos_opsec_introduction\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/kerberos_opsec_introduction\/#primaryimage","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/kerberos_opsec_introduction\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"Kerberos OPSEC: Offense & Detection Strategies for Red and Blue Team – Introduction"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/8b3c61dad317a9965e5084f0da156e55","name":"Pierre Livet","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=retro&r=g","caption":"Pierre Livet"},"url":"https:\/\/www.intrinsec.com\/en\/author\/pierre-livet\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/227378","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=227378"}],"version-history":[{"count":6,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/227378\/revisions"}],"predecessor-version":[{"id":231489,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/227378\/revisions\/231489"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=227378"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=227378"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=227378"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-1.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-2.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-3.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-4.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-5.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-6.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-7.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-8.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-9.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-10.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-11.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-12.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-13.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-14.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-15.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2023\/12\/image-16.png\")
<\/figure>\n\n\n\n