Glossary

Short definitions for the terms you will see in the labs. Use the search box to jump to a term.

Search terms

Active Directory (AD DS): Microsoft's directory service. It stores users, computers, groups, and policies, and controls who can log on to what.
Domain: A security boundary in AD. Users, computers, and policies live in a domain, for example cybertection.lab.
Forest: One or more domains that share a schema and trust each other. The forest is the top-level security boundary.
Domain controller (DC): A server that runs AD DS. It answers logon requests and holds a copy of the directory.
OU (Organizational Unit): A container for objects such as users and computers. OUs are where Group Policy is usually linked.
Group Policy (GPO): Settings applied to users or computers, such as drive mappings, password rules, or security options.
DNS SRV record: A DNS record that tells clients where the domain controllers and services are. Domain join and logon depend on it.
Kerberos: The default authentication protocol in AD. It uses tickets instead of sending passwords over the network.
KDC (Key Distribution Center): The domain controller service that issues Kerberos tickets.
TGT (Ticket Granting Ticket): The ticket a user gets at logon. It proves identity to the KDC and is encrypted with the krbtgt key.
TGS / service ticket: A ticket for one service, requested with a TGT. It is encrypted with the service account's key.
krbtgt: The built-in account whose key encrypts every TGT in the domain. Its key is the most valuable secret in AD.
Pre-authentication: A step where the user proves they know their password before the KDC issues a TGT. Turning it off enables AS-REP roasting.
SPN (Service Principal Name): A name that links a service to the account that runs it, such as MSSQLSvc/.... Accounts with SPNs can be targeted with Kerberoasting.
NTLM: An older Windows authentication protocol that uses a hash of the password. It is still used in some places and is a common target.
Password hash (NT hash): A one-way transformation of a password. Systems store hashes, not passwords, but a stolen hash can still be used in some protocols.
RC4 (encryption type 0x17): An older Kerberos encryption type. Seeing it in service ticket requests is a signal worth investigating.
Password spraying: Trying one or a few common passwords against many accounts, to avoid lockouts.
Lockout threshold: The number of failed logons that locks an account for a set time. Spraying is designed to stay under it.
LSASS: The Windows process that holds logon credentials in memory. Credential-dumping tools target it, so access to it is monitored.
Replication: How domain controllers copy directory changes between each other. Accounts with replication rights can request the password data.
ACL (Access Control List): The list of permissions on an AD object. Misconfigured ACLs are a common way to reach Domain Admin.
Domain Admins: The group with full control of the domain. Keep it as small as possible.
Tiering: A model that separates admin accounts by what they manage, so a compromise of a workstation cannot reach the domain controllers.
gMSA (group Managed Service Account): A service account whose password is long, random, and rotated automatically. It is the fix for most Kerberoasting risk.
LAPS: Windows LAPS manages a unique, rotated local administrator password for each machine. It stops one stolen local password from working everywhere.
Protected Users: A security group that blocks NTLM, DES, and RC4 for its members and shortens Kerberos ticket lifetimes.
Audit policy: The Windows setting that decides which events are recorded, such as logons, Kerberos requests, and directory access.
Event ID: A number that identifies the type of Windows log entry. For example, 4625 is a failed logon and 4769 is a service ticket request.
Sysmon: A free Microsoft tool that adds detailed process, network, and access logging to Windows.
SIEM: A system that collects logs from many sources and lets analysts search and alert on them. Splunk and Microsoft Sentinel are common examples.
Purple team: Attackers and defenders working together, with each attack paired with the detection that should catch it.
Snapshot: A saved state of a virtual machine. Take one before each attack so you can revert the lab.