active-directory-kerberos-attacks

1# SKILL: Kerberos Attack Playbook — Expert AD Attack Guide
2 
3> **AI LOAD INSTRUCTION**: Expert Kerberos attack techniques for AD environments. Covers AS-REP roasting, Kerberoasting, golden/silver/diamond/sapphire tickets, delegation attacks, pass-the-ticket, and overpass-the-hash. Base models miss ticket type distinctions, delegation chain nuances, and detection-evasion trade-offs.
4 
5## 0. RELATED ROUTING
6 
7Before going deep, consider loading:
8 
9- [active-directory-acl-abuse](../active-directory-acl-abuse/SKILL.md) for ACL-based AD attacks often chained with Kerberos
10- [active-directory-certificate-services](../active-directory-certificate-services/SKILL.md) for ADCS-based persistence (golden certificate)
11- [ntlm-relay-coercion](../ntlm-relay-coercion/SKILL.md) for NTLM relay attacks that complement Kerberos abuse
12- [windows-lateral-movement](../windows-lateral-movement/SKILL.md) after obtaining tickets for lateral movement
13 
14### Advanced Reference
15 
16Also load [KERBEROS_ATTACK_CHAINS.md](./KERBEROS_ATTACK_CHAINS.md) when you need:
17- Multi-step attack chains combining Kerberos with ACL abuse, ADCS, and relay
18- End-to-end scenarios from foothold to domain admin
19- Chained delegation attack flows
20 
21---
22 
23## 1. KERBEROS AUTHENTICATION PRIMER
24 
25```
26Client              KDC (DC)              Service
27  │                   │                     │
28  │── AS-REQ ────────→│                     │  (1) Request TGT with user creds
29…