Windows Security

Notes on Windows authentication, credential attacks, and lateral movement techniques.

Directory map

• Windows Authentication Process — NTLM, Kerberos, authentication modules, logon flow
• Windows Logon Types — logon type codes, Event IDs 4624/4625, security monitoring significance
• Pass the Hash (PtH) — NTLM hash reuse, tools (Mimikatz, CrackMapExec, Impacket), mitigations
• Pass the Ticket (PtT) — Kerberos ticket theft, import/export, tools (Rubeus, Mimikatz)
• Pass the Certificate (PtC) — X.509 certificate-based TGT requests, PKINIT, AD CS abuse
• Attacking Active Directory (ADDS) — dictionary attacks against AD accounts, NTDS.dit hash extraction
• Attacking Windows Credential Manager — credential vault enumeration, extraction techniques

Summary

Windows authentication relies on two primary protocols: NTLM (challenge-response, used for legacy and local auth) and Kerberos (ticket-based, preferred in domain environments). Understanding the logon flow — from the winlogon process through LSASS to the authentication packages — is essential for both offensive and defensive work.

Credential-based lateral movement attacks exploit Windows authentication mechanisms without requiring plaintext passwords. Pass the Hash reuses NTLM hashes to authenticate to remote services. Pass the Ticket imports stolen Kerberos tickets (.kirbi) to impersonate users. Pass the Certificate leverages X.509 certificates obtained through AD CS exploitation or Shadow Credentials attacks to request TGTs via PKINIT.