T1558 Steal or Forge Kerberos Tickets Mappings

Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket.

Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Attackers may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.

View in MITRE ATT&CK®

NIST 800-53 Mappings

Azure Mappings

Loading, please wait
Capability ID
Capability Description
Mapping Type
ATT&CK ID
ATT&CK Name
Notes
alerts_for_windows_machines Alerts for Windows Machines technique_scores T1558 Steal or Forge Kerberos Tickets
Comments
This control's detection is specific to a minority of this technique's sub-techniques resulting in a Minimal Coverage score and consequently an overall score of Minimal.
References
azure_sentinel Azure Sentinel technique_scores T1558 Steal or Forge Kerberos Tickets
Comments
This control only provides minimal to partial coverage for some this technique's sub-techniques, resulting in an overall score of Minimal.
References
microsoft_defender_for_identity Microsoft Defender for Identity technique_scores T1558 Steal or Forge Kerberos Tickets
Comments
This control provides partial detection for most of this technique's sub-techniques, resulting in an overall Partial score.
References
azure_defender_for_app_service Azure Defender for App Service technique_scores T1558 Steal or Forge Kerberos Tickets
azure_ad_identity_secure_score Azure AD Identity Secure Score technique_scores T1558 Steal or Forge Kerberos Tickets
Showing 1 to 5 of 5 rows

ATT&CK Subtechniques

Loading, please wait
Technique ID
Technique Name
Number of Mappings
T1558.004 AS-REP Roasting 22
T1558.001 Golden Ticket 13
T1558.003 Kerberoasting 23
T1558.002 Silver Ticket 20
Showing 1 to 4 of 4 rows