BRONZE BUTLERG0060 ↗
Has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.1
tfMITRE ATT&CK sub-technique
Pass the Ticket T1550.003
sub-technique of T1550 Use Alternate Authentication Material
- Tactic
- Lateral Movement
- Platform
- Windows
- Version
- 2.0
- Created
- 30 January 2020
- Last modified
- 12 May 2026
- Contributors
- Ryan Becwar; Vincent Le Toux
Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.11
Detection rulesTop 23%
Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.Pass the Ticket MITRE reference T1550.003
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
APT32G0050 ↗
Successfully gained remote access by using pass the ticket.1
APT29G0016 ↗
Used Kerberos ticket attacks for lateral movement.1
All 3 groups for this technique
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
PupyS0192 ↗
Can also perform pass-the-ticket.1
SeaDukeS0053 ↗
Some SeaDuke samples have a module to use pass the ticket with Kerberos for authentication.1
MimikatzS0002 ↗
Mimikatz’s LSADUMP::DCSync and KERBEROS::PTT modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.1234
All 3 software entries for this technique
Offense vs defense T1550.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 7Splunk ESCU (cumulative) · 4
first rule: 2018 Q4Pass the Ticket detection strategy DET0352
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for T1550.003 - Pass the Ticket (Windows)
1 platform
AN1000 · Windows
Detects unauthorized Kerberos ticket injection by correlating service ticket (TGS - 4769) requests with absent corresponding account logons (4624) and prior Ticket Granting Ticket (TGT - 4768) activity. Highlights anomalous service ticket generation chains involving unexpected users, hosts, or times, and suspicious injection of tickets via mimikatz-like tooling into LSASS memory. Behavior also includes network lateral movement using Kerberos authentication absent expected interactive logon patterns.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | WinEventLog:Security | EventCode=4769 |
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
| Active Directory Credential RequestDC0084 | WinEventLog:Security | EventCode=4768 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Defines the correlation window between TGT request (4768) and TGS request (4769) |
| HostContextScope | Adjusts the host scoping for correlation of authentication chains and ticket injection |
| LSASSAccessAnomalyThreshold | Allows tuning of alerts for ticket injection attempts via LSASS memory access |
To contain the impact of a previously generated golden ticket, reset the built-in KRBTGT account password twice, which will invalidate any existing golden tickets that have been created with the KRBTGT hash and other Kerberos tickets derived from it. For each domain, change the KRBTGT account password once, force replication, and then change the password a second time. Consider rotating the KRBTGT account password every 180 days.
Password PoliciesM1027
Ensure that local administrator accounts have complex, unique passwords.
Limit domain admin account permissions to domain controllers and limited servers. Delegate other admin functions to separate accounts.
Do not allow a user to be a local administrator for multiple systems.
Tests2Executorscmd 1 · PowerShell 1Need elevation1 of 2Have prerequisites2Have cleanup0Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition