Golden Ticket: Forged Kerberos TGT Persistence
A threat actor who already extracted the krbtgt hash from a domain workstation forged Kerberos TGTs offline and used them to access any domain resource without re-touching the domain controller. The telltale signs are RC4-encrypted TGS requests with no preceding AS-REQ and a domain controller that starts beaconing outbound. Reconstruct the full chain from LSASS extraction to C2 beacon using Windows Security events and XDR process telemetry.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Trace the hash extraction
30Before any forged ticket was created, something had to harvest the raw key material. Identify the process that extracted credential material from the operating system's credential store on the foothold workstation.
Identify the forging step
30After extracting the krbtgt hash, the operator ran a second tool to construct and inject a forged Kerberos ticket. Find the SHA-256 hash of that ticket-forging utility.
Spot the anomalous ticket request
25A forged TGT leaves a detectable trace when the operator requests a service ticket. Review the Kerberos event sequence on the domain controller and identify the encryption type that betrays the forged credential.
Confirm the missing prerequisite
20Normal Kerberos authentication produces a TGT request before any TGS request from the same source. Establish whether a TGT request (Event 4768) was logged from the foothold IP before the anomalous TGS events.
Trace access to the file server
25Armed with a forged domain-admin identity, the operator authenticated to the file server. Confirm which host the forged ticket was used against and what share was accessed.
Identify the lateral tool on the domain controller
20After accessing the file server, the operator staged a renamed tool on the domain controller and executed it as a remote service. Identify the tool by its filename.
Locate the command-and-control endpoint
20The tool staged on the domain controller immediately established an outbound connection to an external address. Identify that IP address.
7 tasks · 170 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allCisco IOS XE Web UI: Implant and Rogue Admin (CVE-2023-20198)
The Cisco IOS XE Web UI management interface on AXFORD-RTR-01 was inadvertently exposed to the internet. An attacker exploited CVE-2023-20198 to create an unauthenticated privilege-15 local account, then chained CVE-2023-20273 to drop a Lua implant on the device flash filesystem. The implant hooked the HTTP server and beaconed to an external C2 address. Reconstruct the full compromise chain from the router syslog and the perimeter firewall.
Copyright Lure to Rhadamanthys Stealer
A procurement officer opened a copyright-infringement notice, followed a shortened link, and ran a signed PDF reader out of a Downloads folder. Follow the chain from a CDN-fronted delivery domain through a DLL search-order hijack and a Run-key autostart to the Rhadamanthys stealer's single command-and-control channel, where the beacon and the stolen data ride together.
PaperCut RCE to Bl00dy Ransomware
Bl00dy ransomware actors exploited an unauthenticated access-control flaw (CVE-2023-27350) on an internet-facing PaperCut MF/NG print-management server, ran code as the application service account, staged a TrueBot loader and a Cobalt Strike beacon, installed Atera and AnyDesk for hands-on remote access, moved laterally over RDP, tunnelled the file share out through a Tor helper, and deployed the Bl00dy encryptor fleet-wide. Reconstruct the intrusion from SIEM, endpoint XDR, and perimeter firewall telemetry and classify the key ATT&CK techniques.