Adversaries who possess a target service account's password-derived key, such as its NTLM hash, can forge a Kerberos Ticket-Granting Service (TGS, or service) ticket for a particular resource and present it directly to the hosting service without requesting that ticket from the Key Distribution Center (KDC).
Version: RESTRICTED_ACCESS_BLUR_MARKER. Requirements: none specified (operational prerequisites may still apply)Documents all requested outcomes. This is a candidate, not proof of execution or compatibility.preconditions: RESTRICTED_ACCESS_BLUR_MARKERdependencies: RESTRICTED_ACCESS_BLUR_MARKERverification: RESTRICTED_ACCESS_BLUR_MARKERfailure modes: RESTRICTED_ACCESS_BLUR_MARKERlimitations: RESTRICTED_ACCESS_BLUR_MARKER