34 lines
791 B
Markdown
34 lines
791 B
Markdown
# Windows Pivot And Kerberos Checklist
|
|
|
|
## Pivot Chain
|
|
|
|
Write the chain explicitly:
|
|
|
|
- source host
|
|
- recovered artifact
|
|
- replay protocol or service
|
|
- destination host
|
|
- resulting capability
|
|
|
|
## Kerberos Fields To Keep
|
|
|
|
- Ticket type
|
|
- SPN
|
|
- Delegation mode
|
|
- PAC or group data
|
|
- Encryption type
|
|
- Cache location
|
|
- Accepting service
|
|
|
|
## Host Evidence To Keep
|
|
|
|
- Event IDs, logon IDs, process creation, service creation, task creation
|
|
- WinRM, SMB, RDP, WMI, admin-share, and remote-registry traces
|
|
- Group membership or token changes on the destination host
|
|
|
|
## Common Pitfalls
|
|
|
|
- Treating possession of a ticket as proof of accepted privilege
|
|
- Saying a pivot worked without showing the destination-side effect
|
|
- Mixing several hops into one vague statement instead of a reproducible chain
|