API Reference
Class
GoldenTicketDetector
Parses Kerberos security logs looking for indicators of Golden Ticket attacks.
Inheritance
- Object
- GoldenTicketDetector
Remarks
See usage examples in the unit tests for typical scenarios.
Constructors
public GoldenTicketDetector(Func<String, IEnumerable<KerberosTicketEvent>> getEvents = null) #Initializes a new instance of the GoldenTicketDetector class.
Parameters
- getEvents System.Func{System.String,System.Collections.Generic.IEnumerable{ADPlayground.KerberosTicketEvent}} = null
- Delegate retrieving Kerberos events.
Methods
public Void Audit(String computerName = null, Nullable<TimeSpan> lifetimeThreshold = null) #Returns:
VoidLogs warnings for suspicious Kerberos activity on the specified computer.
Parameters
- computerName System.String = null
- Target computer or null for local.
- lifetimeThreshold System.Nullable{System.TimeSpan} = null
- Threshold for ticket lifetime.
public IEnumerable<KerberosTicketEvent> GetSuspiciousEvents(String computerName = null, Nullable<TimeSpan> lifetimeThreshold = null) #Returns:
IEnumerable<KerberosTicketEvent>Enumerates suspicious Kerberos events from the specified computer.
Parameters
- computerName System.String = null
- Target computer or null for local.
- lifetimeThreshold System.Nullable{System.TimeSpan} = null
- Threshold for ticket lifetime.
Returns
Collection of suspicious events.