T1558
Steal or Forge Kerberos Tickets
Linux · macOS · Windows4 pieces on this siteT1558 on attack.mitre.org
Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).
If this is happening now
Checklists and playbooks to open while the alert is still live.
Domain-level access you cannot account for
An unexplained Domain Admin, directory replication by something that is not a domain controller, or a ticket that does not match any authentication.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: six service tickets in four seconds
A burst of Kerberos service ticket requests from one workstation, every one of them legitimate as far as the domain controller is concerned. Find what makes the cluster abnormal, separate it from a legacy application, and say what the log cannot tell you.
Seventeen hours at Calderbrook: from a password spray to data leaving
A constructed intrusion laid out against the clock and the ATT&CK tactics, following the same four stages as the guided labs. Eleven events, one of them inferred, and one tactic conspicuously missing.
Read
Analyses, case studies, guides, references and interview questions.
Windows event log cheat sheet: by the question you are asking
Organised by what you are trying to establish rather than by number: who logged on and how, what ran, what persisted, what was tampered with. Every entry says which log, whether it is on by default, and what it does not tell you.
how MITRE says to see it
Detect Kerberos Ticket Theft or Forgery (T1558)
- Detects anomalous Kerberos activity such as forged or stolen tickets by correlating malformed fields in logon events, RC4-encrypted TGTs, or TGS requests without corresponding TGT requests. Also detects suspicious processes accessing LSASS memory for ticket extraction.
- Detects suspicious access to SSSD secrets database and Kerberos key material indicating ticket theft or replay attempts. Correlates anomalous file access with unusual Kerberos service ticket requests.
- Detects attempts to forge or replay Kerberos tickets by monitoring Unified Logs for anomalous kinit/klist activity and correlating unusual authentication sequences.
what reduces it
- M1015 Active Directory Configuration. For containing the impact of a previously generated golden ticket, reset the built-in KRBTGT account password twice, which will invalidate any existing golden tickets that have been created with the KRBTGT hash and other Kerberos tickets derived from it. For each domain, change the KRBTGT account password once, force replication, and then change the password a second time.
- M1043 Credential Access Protection. On Linux systems, protect resources with Security Enhanced Linux (SELinux) by defining entry points, process types, and file labels.
- M1041 Encrypt Sensitive Information. Enable AES Kerberos encryption (or another stronger encryption algorithm), rather than RC4, where possible.
- M1027 Password Policies. Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire. Also consider using Group Managed Service Accounts or another third party product such as password vaulting.
- M1047 Audit. Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
- M1026 Privileged Account Management. Limit domain admin account permissions to domain controllers and limited servers. Delegate other admin functions to separate accounts. Limit service accounts to minimal required privileges, including membership in privileged groups such as Domain Administrators.