Steal or Forge Kerberos Tickets

What is Steal or Forge Kerberos Tickets?

Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket attacks. Kerberos is an authentication protocol widely used in Windows domain environments. The protocol uses tickets to authenticate users to services without requiring repeated password entry. Attackers can steal existing tickets from memory, forge new tickets using domain secrets (Golden Ticket and Silver Ticket attacks), or request service tickets for offline brute forcing (Kerberoasting). A Golden Ticket attack uses the Kerberos service account (KRBTGT) hash to forge unlimited TGTs for any account in the domain, providing persistent, unrevocable access until the KRBTGT password is reset twice. These attacks can persist even after account password changes because the forged tickets use the compromised KRBTGT key.

“Steal or Forge Kerberos Tickets is documented as technique T1558 in the MITRE ATT&CK knowledge base under the Credential Access tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Steal or Forge Kerberos Tickets activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Detect Golden Ticket attacks by monitoring for Kerberos TGTs with unusually long validity periods, inconsistent user SID values, or attributes that do not match expected domain configurations.

2. 2

   Alert on Kerberoasting activity by monitoring for large volumes of Kerberos service ticket requests using RC4 encryption from single sources, particularly from workstations that would not normally request many service tickets.

3. 3

   Monitor for Pass the Ticket activity by correlating Kerberos ticket usage with the hosts where tickets were originally issued, flagging tickets used from unexpected source machines.

4. 4

   Detect AS-REP Roasting by monitoring for Kerberos pre-authentication failure events for accounts that do not normally require pre-authentication, followed by offline hash cracking attempts.

5. 5

   Implement KRBTGT account monitoring to detect unauthorized access to domain controllers or attempts to extract the KRBTGT hash through DCSync or physical access to domain controller NTDS.dit.

Example Alerts

These realistic alert examples show what Steal or Forge Kerberos Tickets looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Steal or Forge Kerberos Tickets?

SOC analysts detect Steal or Forge Kerberos Tickets (T1558) by monitoring SIEM, XDR telemetry for behavioral anomalies and specific indicators. Key detection methods include detect golden ticket attacks by monitoring for kerberos tgts with unusually long validity periods, inconsistent user sid values, or attributes that do. SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Steal or Forge Kerberos Tickets?

Steal or Forge Kerberos Tickets can be detected using SIEM, XDR platforms. SIEM tools are particularly effective for this technique because they provide visibility into the credential access phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Steal or Forge Kerberos Tickets in real-world attacks?

Steal or Forge Kerberos Tickets is a well-documented MITRE ATT&CK technique in the Credential Access tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Steal or Forge Kerberos Tickets scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Steal or Forge Kerberos Tickets for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Credential Access techniques like Steal or Forge Kerberos Tickets. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.