Definition
Where an Active Directory account does not require Kerberos pre-authentication, an attacker can request authentication material for that account and attack it offline, without needing the account's password to begin.
Why the configuration exists
Pre-authentication is sometimes disabled to accommodate an application or appliance that cannot perform it. The setting is then rarely revisited, and it is not visible in the places people look for privileged-access problems.
Why offline matters
An offline attack is unconstrained by lockout policy, rate limiting or authentication monitoring. It proceeds at the attacker's pace, with no further interaction with the environment, so weak passwords on such accounts are considerably more exposed than the policy suggests.
- Internal Foothold
- Directory Account
- Offline Credential Attack
- Identity
- Privileged Resource
Each hop validated by successful exploitation
Tags
- active directory
- kerberos
- credentials