Precious Gemstones: The New Generation of Kerberos Attacks

Diamond and Sapphire Tickets

Golden Ticket

https://www.youtube.com/watch?v=ABd0dm8MbDo

Only way to stop this attack once the krbtgt hash has been obtained is to roll the krbtgt hash, twice. Or, rebuild the domain from bare metal.