T1558.002sub-technique of T1558 Steal or Forge Kerberos Tickets
Silver Ticket
Windowsnothing on this site yetT1558.002 on attack.mitre.org
Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets. Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detect Forged Kerberos Silver Tickets (T1558.002)
- Detects forged Kerberos Silver Tickets by identifying anomalous Kerberos service ticket activity such as malformed fields in logon events, TGS requests without interaction with the KDC, and access attempts using service accounts outside expected hosts/resources.
what reduces it
- M1027 Password Policies. Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire. Also consider using Group Managed Service Accounts or another third party product such as password vaulting.
- M1026 Privileged Account Management. Limit service accounts to minimal required privileges, including membership in privileged groups such as Domain Administrators.
- M1041 Encrypt Sensitive Information. Enable AES Kerberos encryption (or another stronger encryption algorithm), rather than RC4, where possible.