← Active Directory Compromise IR — Golden Tickets, DCSync, and Full Remediation

Module Quiz

10 questions · Pass at 80%

Question 1 of 10

Event 4769 shows 18 Kerberos service ticket requests in 2 minutes from 'developer1' to SPNs for MSSQLSvc, HTTP, and CIFS services — all with EncryptionType 0x17 (RC4-HMAC). The domain enforces AES256. What is happening?