A Diamond in the Ruff

This post details the "Diamond Ticket" attack — a Kerberos ticket-forging technique that decrypts a legitimately issued TGT, modifies the PAC, recalculates signatures with the KRBTGT key, re-encrypts it, and uses it to access domain resources; it describes implementation in Rubeus, demonstrates accessing a DC C$ share, compares to Golden/Silver tickets, and provides detection guidance and OPSEC considerations.