Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.
El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Mostrando SKILL.md
SKILL.md
Instrucciones de origen · Vista previa de solo lectura
name
detecting-golden-ticket-attacks-in-kerberos-logs
description
Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.
When KRBTGT account hash may have been compromised via DCSync or NTDS.dit extraction
When hunting for forged Kerberos tickets used for persistent domain access
After incident response reveals credential theft at the domain level
When investigating impossible logon patterns (users logging in from multiple locations simultaneously)
During post-breach assessment to determine if Golden Tickets are in use
Detection Gaps & Validation
Modern forgeries beat the classic heuristics. Diamond and sapphire tickets forge realistic 10-hour lifetimes with AES (0x12/0x11), so the "RC4 (0x17) + impossible lifetime" rule misses them. A diamond ticket modifies a real TGT, so a matching 4768 does exist — the "4769 without prior 4768" heuristic fails there too.
PAC validation must be enforced. Forged PACs are only rejected with KB5008380/KB5037754 enforcement enabled. Verify the patch level and the PacRequestorEnforcement registry state; otherwise forged tickets sail through.
Collection gaps create false negatives. The "TGS without preceding TGT" logic only works if 4768/4769 are forwarded from every DC. Missing one DC's logs makes legitimate tickets look forged and forged ones look legitimate.
Hunt the identity, not just crypto: alert on 4769 TargetUserName that does not exist in AD, on injected well-known SIDs (e.g., 519 Enterprise Admins) in the PAC, and on odd/empty RIDs.
Validate the rule fires: in a lab, forge with mimikatz kerberos::golden using RC4 and confirm the 0x17 anomaly query triggers; for remediation, reset KRBTGT twice (both current and prior hashes are valid until the second reset).
Tune false positives: RC4 is legitimate in legacy trusts and old apps. Scope the RC4 rule to domains you know are AES-only, and allowlist known legacy SPNs.
Prerequisites
Windows Security Event IDs 4768, 4769, 4771 on domain controllers
Domain controller audit policy enabling Kerberos Service Ticket Operations
SIEM with ability to correlate Kerberos events across multiple DCs
Workflow
Monitor TGT Requests (Event 4768): Track Kerberos authentication service requests. Golden Tickets bypass the AS-REQ/AS-REP exchange entirely, so the absence of 4768 before 4769 is suspicious.
Detect Encryption Type Anomalies: Golden Tickets often use RC4 (0x17) encryption. If your domain enforces AES (0x12), any RC4 TGT is a red flag. Monitor TicketEncryptionType in Event 4769.
Check Ticket Lifetime Anomalies: Default Kerberos TGT lifetime is 10 hours with 7-day renewal. Golden Tickets can be forged with 10-year lifetimes. Detect tickets with durations exceeding policy.
Hunt for Non-Existent SIDs: Golden Tickets can include arbitrary SIDs (including non-existent accounts or groups). Correlate TGS requests against known AD SID inventory.
Detect TGS Without Prior TGT: When a service ticket (4769) appears without a preceding TGT request (4768) from the same IP/account, this may indicate a pre-existing Golden Ticket.
Monitor KRBTGT Password Age: Track when KRBTGT was last reset. If KRBTGT hash hasn't changed since a known compromise, Golden Tickets from that period remain valid.
Validate PAC Signatures: With KB5008380+ and PAC validation enforcement, domain controllers reject forged PACs. Monitor for Kerberos failures indicating PAC validation errors.
Detection Queries
Splunk -- RC4 Encryption in Kerberos TGS
index=wineventlog EventCode=4769
| where TicketEncryptionType="0x17"
| where ServiceName!="krbtgt"
| stats count by TargetUserName ServiceName IpAddress TicketEncryptionType Computer
| where count > 5
| sort -count
Splunk -- TGS Without Prior TGT
index=wineventlog (EventCode=4768 OR EventCode=4769)
| stats earliest(_time) as first_tgt by TargetUserName IpAddress EventCode
| eventstats earliest(eval(if(EventCode=4768, first_tgt, null()))) as tgt_time by TargetUserName IpAddress
| where EventCode=4769 AND (isnull(tgt_time) OR first_tgt < tgt_time)
| table TargetUserName IpAddress first_tgt tgt_time
KQL -- Golden Ticket Indicators
SecurityEvent
| where EventID == 4769
| where TicketEncryptionType == "0x17"
| where ServiceName != "krbtgt"
| summarize Count=count() by TargetUserName, IpAddress, ServiceName
| where Count > 5
Common Scenarios
Post-DCSync Golden Ticket: After extracting KRBTGT hash, attacker forges TGT with Domain Admin SID, valid for months until KRBTGT is rotated twice.
RC4 Downgrade: Golden Ticket forged with RC4 encryption in an AES-only environment, detectable by encryption type mismatch.
Cross-Domain Golden Ticket: Forged inter-realm TGT used to pivot between AD domains/forests.
Persistence After Remediation: Golden Tickets surviving password resets because KRBTGT was only rotated once (both current and previous hashes are valid).
