While Kerberos "Golden Tickets" and "Silver Tickets" received a lot of press in the second half of 2014, there hasn't been much detail provided on how exactly they work, why they are successful, and how to mitigate them (other than: "don't get pwned"). Kerberos expertise is not required. I walk through how Active Directory (AD) leverages Kerberos for authentication identifying the areas useful for attack. Information presented is useful for both Red Team & Blue Team members. This talk covers the latest attack vectors surrounding Kerberos Golden & Silver Tickets and MS14-068 exploitation. I describe how and why modern Kerberos attacks work, how to mitigate them, and how to detect their use. Since all of these involve forging Kerberos tickets, there are some interesting artifacts that can be identified. Yes, despite what you may have read, there are ways to detect Golden & Silver Ticket usage! I provide key indicators which can be used to identify Kerberos attacks on your network. I walk through the "AD Attacker's Playbook" which describes how an attacker goes from compromising an Active Directory user account to becoming a full Domain Admin (DA). Once the attacker has DA rights, what's next? Some of the topics covered: - Easy recon with PowerShell to identify potential targets (SQL, CMS, Exchange, FIM, webservers, etc.) - Exploiting weak service account passwords as a regular user in AD - Using Silver Tickets for stealthy persistence that won't be detected (until now).