1. Home
  2. ATT&CK Techniques
  3. T1558.001 Golden Ticket

T1558.001 Golden Ticket

Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015) Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection)

Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources. Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.(Citation: ADSecurity Detecting Forged Tickets)

The KDC service runs all on domain controllers that are part of an Active Directory domain. KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets.(Citation: ADSecurity Kerberos and KRBTGT) The KRBTGT password hash may be obtained using OS Credential Dumping and privileged access to a domain controller.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.IR-01.05 Remote access protection Mitigates T1558.001 Golden Ticket
Comments
This diagnostic statement implements security controls and restrictions for remote user access to systems. Remote user access control involves managing and securing how users remotely access systems, such as through encrypted connections and account use policies, which help prevent adversary access.
References
    PR.AA-05.03 Service accounts Mitigates T1558.001 Golden Ticket
    Comments
    This diagnostic statement describes security controls implemented for service accounts (i.e., accounts used by systems to access other systems). Limit service accounts to minimal required privileges to mitigate attempts to steal or forge Kerberos tickets.
    References
      PR.AA-05.02 Privileged system access Mitigates T1558.001 Golden Ticket
      Comments
      This diagnostic statement protects against Golden Ticket through the use of privileged account management and the use of multi-factor authentication.
      References
        DE.CM-06.02 Third-party access monitoring Mitigates T1558.001 Golden Ticket
        Comments
        This diagnostic statement protects against Golden Ticket through the use of privileged account management. Employing auditing, privilege access management, and just in time access protects against adversaries trying to obtain illicit access to critical systems.
        References
          PR.AA-01.01 Identity and credential management Mitigates T1558.001 Golden Ticket
          Comments
          This diagnostic statement protects against Golden Ticket through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
          References

            NIST 800-53 Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            CM-06 Configuration Settings mitigates T1558.001 Golden Ticket
            CM-05 Access Restrictions for Change mitigates T1558.001 Golden Ticket
            IA-05 Authenticator Management mitigates T1558.001 Golden Ticket
            CM-02 Baseline Configuration mitigates T1558.001 Golden Ticket
            IA-02 Identification and Authentication (Organizational Users) mitigates T1558.001 Golden Ticket
            AC-02 Account Management mitigates T1558.001 Golden Ticket
            AC-03 Access Enforcement mitigates T1558.001 Golden Ticket
            AC-05 Separation of Duties mitigates T1558.001 Golden Ticket
            AC-06 Least Privilege mitigates T1558.001 Golden Ticket

            VERIS Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1558.001 Golden Ticket

            Azure Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            microsoft_sentinel Microsoft Sentinel technique_scores T1558.001 Golden Ticket
            Comments
            The Microsoft Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect execution of these sub-techniques via Empire, but does not address other procedures.
            References
            1. https://learn.microsoft.com/en-us/azure/sentinel/overview
            2. https://learn.microsoft.com/en-us/azure/sentinel/hunting
            alerts_for_windows_machines Alerts for Windows Machines technique_scores T1558.001 Golden Ticket
            Comments
            This control may detect commandline parameters consistent with a Kerberos Golden Ticket attack. The following alerts may be generated: "Suspected Kerberos Golden Ticket attack parameters observed".
            References
            1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers
            2. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-windows-machines

            M365 Mappings

            Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
            DEF-ID-E5 Microsoft Defender for Identity Technique Scores T1558.001 Golden Ticket
            Comments
            This control has numerous alerts that can detect Golden Ticket attacks from multiple perspectives. The accuracy of these alerts is unknown resulting in a partial score.
            References
              DEF-SECA-E3 Security Alerts Technique Scores T1558.001 Golden Ticket
              Comments
              Microsoft Defender security alerts explain the suspicious activities detected by Defender for Identity sensors on your network, and the actors and computers involved in each threat. Alert evidence lists contain direct links to the involved users and computers, to help make your investigations easy and direct. Defender security alerts are divided into the following categories or phases, like the phases seen in a typical cyber-attack kill chain. Learn more about each phase, the alerts designed to detect each attack, and how to use the alerts to help protect your network using the following links: Reconnaissance and discovery alerts Persistence and privilege escalation alerts Credential access alerts Lateral movement alerts Other alerts License: A Microsoft 365 security product license entitles customer use of Microsoft Defender XDR.
              References
              1. https://learn.microsoft.com/en-us/defender-for-identity/credential-access-alerts
              DEF-SECA-E3 Security Alerts Technique Scores T1558.001 Golden Ticket
              Comments
              Microsoft Defender security alerts explain the suspicious activities detected by Defender for Identity sensors on your network, and the actors and computers involved in each threat. Alert evidence lists contain direct links to the involved users and computers, to help make your investigations easy and direct. Defender security alerts are divided into the following categories or phases, like the phases seen in a typical cyber-attack kill chain. Learn more about each phase, the alerts designed to detect each attack, and how to use the alerts to help protect your network using the following links: Reconnaissance and discovery alerts Persistence and privilege escalation alerts Credential access alerts Lateral movement alerts Other alerts License: A Microsoft 365 security product license entitles customer use of Microsoft Defender XDR.
              References
              1. https://learn.microsoft.com/en-us/defender-for-identity/persistence-privilege-escalation-alerts
              EID-IDSS-E3 Identity Secure Score Technique Scores T1558.001 Golden Ticket
              Comments
              This control's "Reduce lateral movement path risk to sensitive entities" recommendation can lead to protecting sensitive accounts against Pass-the-Hash and Pass-the-Ticket attacks that may result in an adversary acquiring a golden ticket. It recommends running the Lateral-Movement-Paths report to understand and identify exactly how attackers can move laterally through the monitored network to gain access to privileged identities such as the KRBTGT on the domain controller. Because this is a recommendation, its score has been capped as Partial.
              References