This technique subverts Kerberos by stealing tickets from memory or forging them from domain secrets, enabling Pass-the-Ticket, Golden Ticket (a forged TGT from the krbtgt hash), and Silver Ticket (a forged service ticket) attacks, plus Kerberoasting of service tickets for offline cracking. Detection focuses on Kerberos anomalies: TGTs with implausibly long lifetimes or mismatched SIDs, a burst of service-ticket requests across many SPNs, and encryption-type downgrades that make cracking easier.
Practice detecting Steal or Forge Kerberos Tickets on realistic SIEM, XDR alerts in SOCSimulator Operations.
“Steal or Forge Kerberos Tickets is documented as technique T1558 in MITRE ATT&CK® v19.1 under the Credential Access tactic. Detection requires visibility into SIEM, XDR telemetry.”
The following detection strategies help SOC analysts identify Steal or Forge Kerberos Tickets activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.
Detect Golden Ticket attacks by monitoring for Kerberos TGTs with unusually long validity periods, inconsistent user SID values, or attributes that do not match expected domain configurations.
Alert on Kerberoasting activity by monitoring for large volumes of Kerberos service ticket requests using RC4 encryption from single sources, particularly from workstations that would not normally request many service tickets.
Monitor for Pass the Ticket activity by correlating Kerberos ticket usage with the hosts where tickets were originally issued, flagging tickets used from unexpected source machines.
Detect AS-REP Roasting by monitoring for Kerberos pre-authentication failure events for accounts that do not normally require pre-authentication, followed by offline hash cracking attempts.
Implement KRBTGT account monitoring to detect unauthorized access to domain controllers or attempts to extract the KRBTGT hash through DCSync or physical access to domain controller NTDS.dit.
These realistic alert examples show what Steal or Forge Kerberos Tickets looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.
Authentication event detected for account "Administrator" with a Kerberos TGT valid for 10 years (87600 hours), compared to the domain default of 10 hours. The ticket also contains a non-standard SID value not present in Active Directory. These attributes are definitive indicators of a forged Golden Ticket created using the compromised KRBTGT account hash.
Service ticket for CIFS/FILESERVER-01 was used from workstation WS-TEMP-009, but the corresponding TGT was issued to WS-EXEC-002. Kerberos tickets should be used from the same host where they were issued. This anomaly indicates a Pass the Ticket attack where a ticket was stolen from one machine and replayed from a different machine to access file server resources.
Single source account jdoe requested 89 Kerberos service tickets for various service principal names within 4 minutes. All tickets were requested with RC4-HMAC encryption rather than the stronger AES encryption configured as the domain default. This is a hallmark of Kerberoasting, collecting service tickets for offline dictionary-based password cracking.
We cover Steal or Forge Kerberos Tickets in our Pro simulations. You can also practice the surrounding detection skills for free across SOCSimulator Operations.
In this scenario, you will investigate a high-speed identity-based attack. Starting from an edge device exploitation, an adversary moves laterally to a domain-joined workstation and targets Active Directory. You must analyze SIEM logs for Kerberos ticket anomalies (RC4 encryption), correlate XDR process trees for Impacket usage, and identify the 'malware-free' techniques used to escalate privileges to Domain Admin.
A finance user at Vendt Aerospace opened a mail attachment mid-morning, and within the hour an administrative account was signing in to a server it had no business reaching. Work the domain controller's authentication records and the endpoint process telemetry, separate the intrusion from an estate that produces plenty of traffic that looks similar, and reconstruct how the operator got from one workstation to the directory.
A brute force attack systematically tries large numbers of username and password combinations, or decryption keys, until…
Read more GlossaryMulti-Factor Authentication (MFA) requires a user to prove their identity with two or more independent factors, somethin…
Read more GlossaryLateral movement is the attack phase where adversaries expand access from an initial foothold to additional systems, usi…
Read more GlossarySecurity Information and Event Management (SIEM) is a platform that aggregates, normalizes, and correlates log data from…
Read more Career PathTier 1 SOC Analysts are the front line. You monitor alert queues, triage incoming detections, classify them as true or f…
Read more Career PathIncident Responders lead the technical response when confirmed breaches happen. You coordinate containment, run forensic…
Read more ToolThe SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more ToolThe XDR console in SOCSimulator replicates the investigation workflow of platforms like CrowdStrike Falcon, Microsoft De…
Read more ComparisonSOCSimulator wins on operational realism. You get multi-tool shift simulation with SLA pressure, noise injection, and al…
Read more PlaybookWhen SIEM detects an unusual volume of Kerberos TGS ticket requests (Event ID 4769) with RC4 encryption from a single ac…
Read more GlossaryComplete glossary of Security Operations Center terminology for aspiring SOC analysts.
Read more FeaturePractice alert triage under realistic time pressure with SLA timers and noise injection.
Read more