Golden ticket attacks exploit the trust model of directory services, allowing attackers to generate valid credentials that standard log monitoring often misses entirely.
AS-REP roasting targets accounts with Kerberos pre-authentication disabled, not weak passwords, and yields offline hashes that never touch the domain controller.
