# Attack path: Attacker obtains KRBTGT NTLM hash (via DCSync, # "Audit Kerberos Authentication Service" → Enable SUCCESS and FAILURE # "Audit Kerberos Service Ticket Operations" → Enable SUCCESS and ...