AkiraG1024 ↗
Have used scripts to dump Kerberos authentication credentials.1
tfMITRE ATT&CK technique
Steal or Forge Kerberos Tickets T1558
- Tactic
- Credential Access
- Platforms
- Linux, macOS, Windows
- Version
- 1.7
- Created
- 11 February 2020
- Last modified
- 12 May 2026
- Contributors
- Tim (Wadhwa-)Brown; Cody Thomas, SpecterOps
Sub-techniques 545 rules across the family · 12 mapped directly to T1558 · 4 of 5 carry rules
Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).[1] Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.12
Detection rulesTop 21%
Detection rules79th percentile · 79% of ATT&CK techniques have this many detection rules written or fewer.Steal or Forge Kerberos Tickets MITRE reference T1558
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries used the Rubeus tool to forge a Diamond Ticket that is a modified legitimate Kerberos ticket.1
All 1 campaigns for this technique
Offense vs defense T1558
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 6
first rule: 2018 Q3 · 1 of 1 campaigns plottedSteal or Forge Kerberos Tickets detection strategy DET0522
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Kerberos Ticket Theft or Forgery (T1558)
3 platforms
AN1443 · Windows
Detects anomalous Kerberos activity such as forged or stolen tickets by correlating malformed fields in logon events, RC4-encrypted TGTs, or TGS requests without corresponding TGT requests. Also detects suspicious processes accessing LSASS memory for ticket extraction.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| Logon Session MetadataDC0088 | WinEventLog:Security | EventCode=4672, 4634 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TicketLifetimeThreshold | Threshold for Kerberos TGT lifetimes deviating from domain defaults. |
| EncryptionTypes | Monitor for downgraded encryption types (e.g., RC4) in Kerberos tickets. |
| ProcessAllowlist | List of expected processes accessing LSASS; deviations may be suspicious. |
AN1444 · Linux
Detects suspicious access to SSSD secrets database and Kerberos key material indicating ticket theft or replay attempts. Correlates anomalous file access with unusual Kerberos service ticket requests.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | auditd:SYSCALL | Access to /var/lib/sss/secrets/secrets.ldb or .secrets.mkey |
| Active Directory Credential RequestDC0084 | linux:syslog | Unusual kinit or klist activity |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SecretsAccessThreshold | Alert threshold for frequency of access to Kerberos secrets files. |
| UnusualServiceAccounts | Baseline accounts normally performing Kerberos requests; anomalies flagged. |
AN1445 · macOS
Detects attempts to forge or replay Kerberos tickets by monitoring Unified Logs for anomalous kinit/klist activity and correlating unusual authentication sequences.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Logon Session MetadataDC0088 | macos:unifiedlog | Unusual Kerberos TGS-REQ without TGT or anomalous ticket lifetime |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TicketRequestPatterns | Expected sequence of TGT followed by TGS requests; deviations may indicate forgery. |
| TicketLifetime | Expected ticket lifetimes; anomalies may indicate Golden or Silver Tickets. |
For containing the impact of a previously generated golden ticket, reset the built-in KRBTGT account password twice, which will invalidate any existing golden tickets that have been created with the KRBTGT hash and other Kerberos tickets derived from it. For each domain, change the KRBTGT account password once, force replication, and then change the password a second time. Consider rotating the KRBTGT account password every 180 days.
AuditM1047
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
On Linux systems, protect resources with Security Enhanced Linux (SELinux) by defining entry points, process types, and file labels.
Enable AES Kerberos encryption (or another stronger encryption algorithm), rather than RC4, where possible.
Password PoliciesM1027
Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire. Also consider using Group Managed Service Accounts or another third party product such as password vaulting.
Limit domain admin account permissions to domain controllers and limited servers. Delegate other admin functions to separate accounts. Limit service accounts to minimal required privileges, including membership in privileged groups such as Domain Administrators.