hard20 pts · first answer countsactive-directory-securityincident-response
Evicting a Golden Ticket attacker
Investigators believe an attacker stole the krbtgt account hash and is forging Kerberos TGTs (Golden Tickets). Which remediation step is required to invalidate those tickets?
Discussion 0
Join free to post in the discussion.
Related questions
- Backups that survive ransomwareCybersecurity Analyst
- Why chain of custody mattersCybersecurity Analyst
- NIST incident response lifecycleCybersecurity Analyst
- Containing a hijacked Microsoft 365 accountCybersecurity Analyst
- What EDR host isolation doesCybersecurity Analyst
- What evidence to collect firstCybersecurity Analyst
- File integrity alert on a web serverCybersecurity Analyst
- Artefacts of PsExec lateral movementCybersecurity Analyst