Steal or Forge Kerberos Tickets

What is Steal or Forge Kerberos Tickets?

“Steal or Forge Kerberos Tickets is documented as technique T1558 in MITRE ATT&CK® v19.1 under the Credential Access tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Steal or Forge Kerberos Tickets activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Detect Golden Ticket attacks by monitoring for Kerberos TGTs with unusually long validity periods, inconsistent user SID values, or attributes that do not match expected domain configurations.

2. 2

   Alert on Kerberoasting activity by monitoring for large volumes of Kerberos service ticket requests using RC4 encryption from single sources, particularly from workstations that would not normally request many service tickets.

3. 3

   Monitor for Pass the Ticket activity by correlating Kerberos ticket usage with the hosts where tickets were originally issued, flagging tickets used from unexpected source machines.

4. 4

   Detect AS-REP Roasting by monitoring for Kerberos pre-authentication failure events for accounts that do not normally require pre-authentication, followed by offline hash cracking attempts.

5. 5

   Implement KRBTGT account monitoring to detect unauthorized access to domain controllers or attempts to extract the KRBTGT hash through DCSync or physical access to domain controller NTDS.dit.

Example Alerts

These realistic alert examples show what Steal or Forge Kerberos Tickets looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Steal or Forge Kerberos Tickets?

Detection centers on SIEM, XDR telemetry for the credential access phase of the attack. Detect Golden Ticket attacks by monitoring for Kerberos TGTs with unusually long validity periods, inconsistent user SID values, or attributes that do not match expected domain configurations. Alert on Kerberoasting activity by monitoring for large volumes of Kerberos service ticket requests using RC4 encryption from single sources, particularly from workstations that would not normally request many service tickets.

What does a Steal or Forge Kerberos Tickets alert look like?

A representative SIEM detection is "Kerberos Golden Ticket Attack Indicators" (critical severity): Authentication event detected for account "Administrator" with a Kerberos TGT valid for 10 years (87600 hours), compared to the domain default of 10 hours. The ticket also contains a non-standard SID value not present in Active Directory. These attributes are definitive indicators of a forged Golden Ticket created using the compromised KRBTGT account hash.

Which tools detect Steal or Forge Kerberos Tickets, and how can I practice?

Steal or Forge Kerberos Tickets (T1558) is best surfaced with SIEM, XDR telemetry, which exposes the credential access signals described above. SOCSimulator covers it in Pro simulations on those consoles; the surrounding detection skills are free to practice in SOCSimulator Operations.