T1558 · Steal or Forge Kerberos Tickets

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1558 · Steal or Forge Kerberos Tickets · Sunturai

attack-patternenterprise-attackT1558

Steal or Forge Kerberos Tickets

attack-pattern--3fc01293-ef5e-41c6-86ce-61f10706b64a

Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)

Created: Feb 11, 2020, 7:12 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

5 sub-techniques under this technique

Each is its own technique in the catalogue, with its own detections.

32 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Silverfort - Kerberos checksum mismatch	High	Microsoft Sentinel analytics	Oct 14, 2026	MIT License
User account exposed to Kerberoasting	Medium	Elastic detection rules	Oct 8, 2026	Elastic License 2.0
Windows Kerberos Local Successful Logon	Medium	Splunk security content	Oct 6, 2026	Apache License 2.0
Windows Domain Admin Impersonation Indicator	Medium	Splunk security content	Oct 6, 2026	Apache License 2.0
First Time Python Accessed Sensitive Credential Files	Medium	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Service Creation via Local Kerberos Authentication	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
KRBTGT Delegation Backdoor	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Kerberos Authentication Ticket Request	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential PowerShell HackTool Script by Function Names	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Sensitive Privilege SeEnableDelegationPrivilege assigned to a Principal	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
PowerShell Kerberos Ticket Request	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
PowerShell Kerberos Ticket Dump	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
PKINIT Followed by Same-Principal U2U Service Ticket	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Invoke-Mimikatz PowerShell Script	Critical	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kirbi File Creation	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Newly Observed RC4 Kerberos Service Ticket Request	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kerberos Traffic from Unusual Process	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kerberos Pre-authentication Disabled for User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Kerberos Attack via Bifrost	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kerberos Cached Credentials Dumping	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Kerberoasting	Medium	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
Pathlock TDnR - Kerberos Keytab Changes	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Potential Privilege Escalation via Local Kerberos Relay over LDAP	High	Elastic detection rules	Aug 27, 2026	Elastic License 2.0
Windows Steal or Forge Kerberos Tickets Klist	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Computer Account With SPN	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0

Showing 25 of 32

Filter in the catalogue

External references

mitre-attackT1558Open reference

CERT-EU Golden Ticket ProtectionOpen reference

Microsoft Detecting Kerberoasting Feb 2018Open reference

Medium Detecting Attempts to Steal Passwords from MemoryOpen reference

Stealthbits Detect PtT 2019Open reference

AdSecurity Cracking Kerberos Dec 2015Open reference

ADSecurity Detecting Forged TicketsOpen reference

Microsoft Kerberos Golden TicketOpen reference

Microsoft KlistOpen reference

ADSecurity Kerberos Ring DecoderOpen reference

Platforms

LinuxmacOSWindows

Kill chain phases

credential-access

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object