Cross-source coverage
T1558.002 / ATT&CK
Steal or Forge Kerberos Tickets: Silver Ticket
2 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.
Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.
Password hashes for target services may be obtained using OS Credential Dumping or Kerberoasting.
- Tactics
- Credential Access
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:KerberosWinEventLog:Sysmon
How MITRE says to detect it DET0241
Detect Forged Kerberos Silver Tickets (T1558.002)
Windows Analytic 0675
Detects forged Kerberos Silver Tickets by identifying anomalous Kerberos service ticket activity such as malformed fields in logon events, TGS requests without interaction with the KDC, and access attempts using service accounts outside expected hosts/resources. Also monitors suspicious processes accessing LSASS memory for credential dumping.
WinEventLog:SecurityEventCode=4672, 4634WinEventLog:KerberosKerberos TGS-REQ anomalies without KDC validation (Silver Ticket behavior)WinEventLog:SysmonEventCode=10
Bert-JanP/Hunting-Queries-Detection-Rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Kerberos attacks | Undefined | KQL |
SigmaHQ/sigma
1 rule| Detection | Severity | Format |
|---|---|---|
| DC Machine Account Network Logon from Non-DC Source IP | Critical | Sigma |