---
name: rt-scenario-n005
description: "N-005: Kerberos trust and ticket-lifetime persistence risk assessment. Domain: network. Authorized Active Directory scenario focused on KRBTGT hygiene, delegation, privileged accounts, detection, and remediation."
---

# N-005: Kerberos Privilege Persistence Risk

## Overview

This scenario evaluates whether Kerberos configuration and privileged account hygiene could allow long-lived domain persistence. It does not require creating forged tickets in production; most value comes from configuration review, rotation history, and detection readiness.

| Field | Value |
|---|---|
| Domain | Active Directory |
| Objective | Assess Kerberos persistence risk |
| Required Access | Directory read access or admin-provided exports |
| Detection Risk | Low for review, High for active validation |
| Primary Impact | Long-lived privileged access |

## Prerequisites

- Domain scope approved.
- Read-only review preferred.
- KRBTGT rotation history available if possible.
- SIEM/detection contacts identified.
- No forged ticket activity unless explicitly approved in lab.

## Risk Areas

| Area | Why It Matters |
|---|---|
| KRBTGT Rotation | Stale KRBTGT secrets can extend persistence risk. |
| Ticket Lifetime | Long lifetimes increase abuse window. |
| Privileged Groups | Excess members increase credential exposure. |
| Delegation | Misconfigured delegation can enable privilege paths. |
| Logging | Weak Kerberos monitoring delays detection. |

## Workflow

1. Collect domain policy and Kerberos settings.
2. Review KRBTGT rotation date and process.
3. Review privileged group membership.
4. Review delegation settings and service accounts.
5. Review detection coverage for unusual tickets and privileged logons.
6. Produce a rotation and monitoring roadmap.

## MITRE ATT&CK Mapping

| Phase | Tactic | Technique |
|---|---|---|
| Persistence | Persistence | Golden Ticket |
| Credential Use | Defense Evasion | Use Alternate Authentication Material |
| Privilege | Privilege Escalation | Valid Accounts |

## Evidence

- Domain policy export.
- KRBTGT password last set date.
- Privileged group review.
- Delegation review.
- Detection rule inventory.

## Remediation

- Rotate KRBTGT safely using a staged process.
- Reduce ticket lifetimes where appropriate.
- Clean privileged group membership.
- Remove risky delegation.
- Monitor anomalous TGT/TGS behavior.
- Tier administrative accounts.

