T1558.001sub-technique of T1558 Steal or Forge Kerberos Tickets
Golden Ticket
Windows1 piece on this siteT1558.001 on attack.mitre.org
Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket. Golden tickets enable adversaries to generate authentication material for any account in Active Directory. Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources.
If this is happening now
Checklists and playbooks to open while the alert is still live.
First-hour playbookMembers
Domain-level access you cannot account for
An unexplained Domain Admin, directory replication by something that is not a domain controller, or a ticket that does not match any authentication.
T1558.001
how MITRE says to see it
Detect Forged Kerberos Golden Tickets (T1558.001)
- Detects forged Kerberos Golden Tickets by correlating anomalous Kerberos ticket lifetimes, unexpected encryption types (e.g., RC4 in modern domains), malformed fields in logon/logoff events, and TGS requests without preceding TGT requests.
what reduces it
- M1026 Privileged Account Management. Limit domain admin account permissions to domain controllers and limited servers. Delegate other admin functions to separate accounts.
- M1015 Active Directory Configuration. For containing the impact of a previously generated golden ticket, reset the built-in KRBTGT account password twice, which will invalidate any existing golden tickets that have been created with the KRBTGT hash and other Kerberos tickets derived from it. For each domain, change the KRBTGT account password once, force replication, and then change the password a second time.