TA0006 · CREDENTIAL ACCESS
Steal or Forge Kerberos Tickets
Kerberoasting, AS-REP roasting, golden and silver tickets abusing Kerberos design.
Detect it with
Event ID 4769 with RC4 encryption (0x17) for many SPNs from one account; TGTs with implausible lifetimes.
Why it matters on shift
Steal or Forge Kerberos Tickets is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
5 sub-techniques
How it shows up in practice
- T1558.001
Golden Ticket
Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket. Golden tickets enable adversaries to generate authentication material for any account in Active Directory.
- T1558.002
Silver Ticket
Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets.
- T1558.003
Kerberoasting
Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.
- T1558.004
AS-REP Roasting
Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages. Preauthentication offers protection against offline Password Cracking.
- T1558.005
Ccache Files
Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials.
Kill-chain context