Detections
Analytics

Golden Ticket

critical

Language:

Description

A Golden Ticket attack gains control over an Active Directory Key Distribution Service account (KRBTGT), and uses that account to create valid Kerberos Ticket Granting Tickets (TGTs).

See Also

MITRE ATT&CK description

CERT Europa - Kerberos Golden Ticket Protection

Reset the krbtgt account password/keys

Indicator Details

Name: Golden Ticket

Codename: I-GoldenTicket

Severity: Critical

Type: Indicator of Attack

MITRE ATT&CK Information:
ID: T1558.001
Sub-technique of: T1558
Tactic: TA0006