T1558 Steal or Forge Kerberos Tickets Mappings

Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket.

Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Attackers may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-16 Security and Privacy Attributes Protects T1558 Steal or Forge Kerberos Tickets
AC-17 Remote Access Protects T1558 Steal or Forge Kerberos Tickets
AC-18 Wireless Access Protects T1558 Steal or Forge Kerberos Tickets
AC-19 Access Control for Mobile Devices Protects T1558 Steal or Forge Kerberos Tickets
AC-2 Account Management Protects T1558 Steal or Forge Kerberos Tickets
AC-3 Access Enforcement Protects T1558 Steal or Forge Kerberos Tickets
AC-5 Separation of Duties Protects T1558 Steal or Forge Kerberos Tickets
AC-6 Least Privilege Protects T1558 Steal or Forge Kerberos Tickets
CA-7 Continuous Monitoring Protects T1558 Steal or Forge Kerberos Tickets
CM-2 Baseline Configuration Protects T1558 Steal or Forge Kerberos Tickets
CM-5 Access Restrictions for Change Protects T1558 Steal or Forge Kerberos Tickets
CM-6 Configuration Settings Protects T1558 Steal or Forge Kerberos Tickets
IA-2 Identification and Authentication (organizational Users) Protects T1558 Steal or Forge Kerberos Tickets
IA-5 Authenticator Management Protects T1558 Steal or Forge Kerberos Tickets
SC-4 Information in Shared System Resources Protects T1558 Steal or Forge Kerberos Tickets
SI-12 Information Management and Retention Protects T1558 Steal or Forge Kerberos Tickets
SI-3 Malicious Code Protection Protects T1558 Steal or Forge Kerberos Tickets
SI-4 System Monitoring Protects T1558 Steal or Forge Kerberos Tickets
SI-7 Software, Firmware, and Information Integrity Protects T1558 Steal or Forge Kerberos Tickets
action.hacking.variety.Use of stolen creds Use of stolen authentication credentials (including credential stuffing) related-to T1558 Steal or Forge Kerberos Tickets

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1558.004 AS-REP Roasting 23
T1558.001 Golden Ticket 11
T1558.003 Kerberoasting 20
T1558.002 Silver Ticket 20