Cross-source coverage

T1558.001 / ATT&CK

Steal or Forge Kerberos Tickets: Golden Ticket

3 rules across 3 sources.

From MITRE ATT&CK 19.2

Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket. Golden tickets enable adversaries to generate authentication material for any account in Active Directory.

Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources. Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.

The KDC service runs all on domain controllers that are part of an Active Directory domain. KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets. The KRBTGT password hash may be obtained using OS Credential Dumping and privileged access to a domain controller.

Platforms
Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmon

How MITRE says to detect it DET0144

Detect Forged Kerberos Golden Tickets (T1558.001)

Windows Analytic 0405

Detects forged Kerberos Golden Tickets by correlating anomalous Kerberos ticket lifetimes, unexpected encryption types (e.g., RC4 in modern domains), malformed fields in logon/logoff events, and TGS requests without preceding TGT requests. Also monitors for abnormal patterns of access associated with elevated privileges across multiple systems.

  • WinEventLog:Security EventCode=4672, 4634
  • WinEventLog:Security EventCode=4769
  • WinEventLog:Sysmon EventCode=10

View on attack.mitre.org ↗

Bert-JanP/Hunting-Queries-Detection-Rules

1 rule
Detection Severity Format
Kerberos attacks Undefined KQL

SigmaHQ/sigma

1 rule
Detection Severity Format
DC Machine Account TGT Request from Non-DC Source IP High Sigma

splunk/security_content

1 rule
Detection Severity Format
Kerberos Service Ticket Request Using RC4 Encryption Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.