Steal or Forge Kerberos Tickets: Golden Ticket (T1558.001)

Tactic: Credential Access · Platforms: Windows

The interactive view maps 1 detection strategy, 2 mitigations, 1 threat group, 4 software entries to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Steal or Forge Kerberos Tickets (T1558).

Overview

Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket. Golden tickets enable adversaries to generate authentication material for any account in Active Directory.

Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources. Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.

The KDC service runs all on domain controllers that are part of an Active Directory domain. KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets. The KRBTGT password hash may be obtained using OS Credential Dumping and privileged access to a domain controller.

Explore

• Open T1558.001 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1558.001
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan