Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015) Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection)
Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources. Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.(Citation: ADSecurity Detecting Forged Tickets)
The KDC service runs all on domain controllers that are part of an Active Directory domain. KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets.(Citation: ADSecurity Kerberos and KRBTGT) The KRBTGT password hash may be obtained using OS Credential Dumping and privileged access to a domain controller.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| AC-2 | Account Management | Protects | T1558.001 | Golden Ticket | |
| AC-3 | Access Enforcement | Protects | T1558.001 | Golden Ticket | |
| AC-5 | Separation of Duties | Protects | T1558.001 | Golden Ticket | |
| AC-6 | Least Privilege | Protects | T1558.001 | Golden Ticket | |
| CM-2 | Baseline Configuration | Protects | T1558.001 | Golden Ticket | |
| CM-5 | Access Restrictions for Change | Protects | T1558.001 | Golden Ticket | |
| CM-6 | Configuration Settings | Protects | T1558.001 | Golden Ticket | |
| IA-2 | Identification and Authentication (organizational Users) | Protects | T1558.001 | Golden Ticket | |
| IA-5 | Authenticator Management | Protects | T1558.001 | Golden Ticket |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| alerts_for_windows_machines | Alerts for Windows Machines | technique_scores | T1558.001 | Golden Ticket |
Comments
This control may detect commandline parameters consistent with a Kerberos Golden Ticket attack. The following alerts may be generated: "Suspected Kerberos Golden Ticket attack parameters observed".
References
|
| azure_sentinel | Azure Sentinel | technique_scores | T1558.001 | Golden Ticket |
Comments
The Azure Sentinel Analytics "Powershell Empire cmdlets seen in command line" query can detect execution of these sub-techniques via Empire, but does not address other procedures.
References
|
| microsoft_defender_for_identity | Microsoft Defender for Identity | technique_scores | T1558.001 | Golden Ticket |
Comments
This control has numerous alerts that can detect Golden Ticket attacks from multiple perspectives. The accuracy of these alerts is unknown resulting in a partial score.
References
|
| azure_ad_identity_secure_score | Azure AD Identity Secure Score | technique_scores | T1558.001 | Golden Ticket |
Comments
This control's "Reduce lateral movement path risk to sensitive entities" recommendation can lead to protecting sensitive accounts against Pass-the-Hash and Pass-the-Ticket attacks that may result in an adversary acquiring a golden ticket. It recommends running the Lateral-Movement-Paths report to understand and identify exactly how attackers can move laterally through the monitored network to gain access to privileged identities such as the KRBTGT on the domain controller. Because this is a recommendation, its score has been capped as Partial.
References
|