ATT&CK ReferencesAdSecurity Kerberos GT Aug 2015

AdSecurity Kerberos GT Aug 2015

Metcalf, S. (2015, August 7). Kerberos Golden Tickets are Now More Golden. Retrieved December 1, 2017.

Techniques1

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1134.005 SID-History Injection	ToolMimikatz	Mimikatz's `MISC::AddSid` module can append any SID or user/group account to a user's SID-History. Mimikatz also utilizes SID-History Injection to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain. AdSecurity Kerberos GT Aug 2015 Adsecurity Mimikatz Guide
T1550.003 Pass the Ticket	ToolMimikatz	Mimikatz’s `LSADUMP::DCSync` and `KERBEROS::PTT` modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets. AdSecurity Kerberos GT Aug 2015 Adsecurity Mimikatz Guide Harmj0y DCSync Sept 2015 NCSC Joint Report Public Tools

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.