Steal or Forge Kerberos Tickets

T1558

Technique with 5 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC). Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.

On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.

Detection rules40

Rules on DetectionCode tagged with T1558 or one of its sub-techniques.

Sigma21

Rule	Level	Log source	Technique
Antivirus - Password Dumper Signature	critical	NULL / antivirus	T1558
HackTool - Mimikatz Kirbi File Creation	critical	windows / file_event	T1558
HackTool - Rubeus Execution	critical	windows / process_creation	T1558.003
HackTool - KrbRelay Execution	high	windows / process_creation	T1558.003
HackTool - KrbRelayUp Execution	high	windows / process_creation	T1558.003
HackTool - RemoteKrbRelay Execution	high	windows / process_creation	T1558.003
HackTool - Rubeus Execution - ScriptBlock	high	windows / ps_script	T1558.003
Register new Logon Process by Rubeus	high	windows / NULL	T1558.003
Replay Attack Detected	high	windows / NULL	T1558
Suspicious Kerberos Ticket Request via CLI	high	windows / process_creation	T1558.003
Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock	high	windows / ps_script	T1558.003
User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'	high	windows / NULL	T1558.003
Kerberoasting Activity - Initial Query	medium	windows / NULL	T1558.003
Kerberos Network Traffic RC4 Ticket Encryption	medium	zeek / NULL	T1558.003
Potential CVE-2021-42287 Exploitation Attempt	medium	windows / NULL	T1558.003
Potential SPN Enumeration Via Setspn.EXE	medium	windows / process_creation	T1558.003
Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock	medium	windows / ps_script	T1558
Suspicious Kerberos RC4 Ticket Encryption	medium	windows / NULL	T1558.003
Uncommon Outbound Kerberos Connection	medium	windows / network_connection	T1558
Uncommon Outbound Kerberos Connection - Security	medium	windows / NULL	T1558.003
No Suitable Encryption Key Found For Generating Kerberos Ticket	low	windows / NULL	T1558.003

Splunk19

Rule	Type	Risk	Data source	Technique
Disabled Kerberos Pre-Authentication Discovery With Get-ADUser	TTP	NULL	Powershell Script Block Logging 4104	T1558.004
Disabled Kerberos Pre-Authentication Discovery With PowerView	TTP	NULL	Powershell Script Block Logging 4104	T1558.004
Kerberoasting spn request with RC4 encryption	TTP	NULL	Windows Event Log Security 4769	T1558.003
Kerberos Pre-Authentication Flag Disabled in UserAccountControl	TTP	NULL	Windows Event Log Security 4738	T1558.004
Kerberos Pre-Authentication Flag Disabled with PowerShell	TTP	NULL	Powershell Script Block Logging 4104	T1558.004
Kerberos Service Ticket Request Using RC4 Encryption	TTP	NULL	Windows Event Log Security 4769	T1558.001
Rubeus Command Line Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1558.003 T1558.004
ServicePrincipalNames Discovery with PowerShell	TTP	NULL	Powershell Script Block Logging 4104	T1558.003
ServicePrincipalNames Discovery with SetSPN	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1558.003
Unusual Number of Kerberos Service Tickets Requested	Anomaly	NULL	Windows Event Log Security 4769	T1558.003
Windows Computer Account Created by Computer Account	TTP	NULL	Windows Event Log Security 4741	T1558
Windows Computer Account Requesting Kerberos Ticket	TTP	NULL	Windows Event Log Security 4768	T1558
Windows Computer Account With SPN	TTP	NULL	Windows Event Log Security 4741	T1558
Windows Domain Admin Impersonation Indicator	TTP	NULL	Windows Event Log Security 4627	T1558
Windows Kerberos Local Successful Logon	TTP	NULL	Windows Event Log Security 4624	T1558
Windows PowerView Kerberos Service Ticket Request	TTP	NULL	Powershell Script Block Logging 4104	T1558.003
Windows PowerView SPN Discovery	TTP	NULL	Powershell Script Block Logging 4104	T1558.003
Windows Process With NetExec Command Line Parameters	TTP	NULL	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1558.003 T1558.004
Windows Steal or Forge Kerberos Tickets Klist	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1558

Sub-techniques5

ID	Name	Examples
T1558.001	Golden Ticket	5
T1558.002	Silver Ticket	4
T1558.003	Kerberoasting	12
T1558.004	AS-REP Roasting	1
T1558.005	Ccache Files	1

Groups1

Akira

Software0

None recorded.

Campaigns1

2025 Poland Wiper Attacks

Procedure examples2

Groups1

Used by	Procedure example
GroupAkira	Akira have used scripts to dump Kerberos authentication credentials. Cisco Akira Ransomware OCT 2024

Campaigns1

Used by	Procedure example
Campaign2025 Poland Wiper Attacks	During the 2025 Poland Wiper Attacks, the adversaries used the Rubeus tool to forge a Diamond Ticket that is a modified legitimate Kerberos ticket. CERT Polska

References2

ADSecurity Kerberos Ring Decoder Open source
Sean Metcalf. (2014, September 12). Kerberos, Active Directory’s Secret Decoder Ring. Retrieved February 27, 2020.
Microsoft Klist Open source
Microsoft. (2021, March 3). klist. Retrieved October 14, 2021.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.