detecting-pass-the-ticket-attacks

name	detecting-pass-the-ticket-attacks
description	Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM. Use when detecting kerberos pass-the-ticket (ptt) attacks by analyzing windows event ids.
domain	cybersecurity
subdomain	threat-detection
tags	["kerberos","pass-the-ticket","active-directory","splunk","elastic","credential-theft","windows-security"]
version	1.0
author	oyi77
license	Apache-2.0
d3fend_techniques	["Token Binding","Execution Isolation","Restore Access","Application Protocol Command Analysis","Process Termination"]
nist_csf	["DE.CM-01","DE.AE-02","DE.AE-06","ID.RA-05"]

Detecting Pass-the-Ticket Attacks

Overview

Pass-the-Ticket (PtT) is a credential theft technique (MITRE ATT&CK T1550.003) where adversaries steal Kerberos tickets (TGT or TGS) from one system and replay them on another to authenticate without knowing the user's password. This skill teaches detection of PtT attacks by correlating Windows Security Event IDs 4768 (TGT request), 4769 (TGS request), and 4771 (pre-authentication failure) for anomalies such as ticket reuse across different hosts, RC4 encryption downgrades, and unusual service ticket request volumes.

When to Use

Trigger phrases:

• "detecting pass the ticket attacks"

• "Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 476"

• When investigating security incidents that require detecting pass the ticket attacks

• When building detection rules or threat hunting queries for this domain

• When SOC analysts need structured procedures for this analysis type

• When validating security monitoring coverage for related attack techniques

Prerequisites

• Windows Domain Controller with advanced audit policy enabled (Audit Kerberos Authentication Service, Audit Kerberos Service Ticket Operations)
• Splunk or Elastic SIEM ingesting Windows Security event logs
• Sysmon deployed on endpoints for supplementary process telemetry
• Python 3.8+ with requests library

Steps

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. Enable Kerberos audit logging on Domain Controllers via Group Policy