Steal or Forge Kerberos Tickets
- ID
- T1558
- Tactics
- TA0006 Credential Access
- Platforms
- Linux, macOS, Windows
- Data sources
- Logon Session Metadata, Process Access, File Access, Active Directory Credential Request
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).[4] Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.
On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.[5]
Sub-techniques (5)
- T1558.001 Golden Ticket
- T1558.002 Silver Ticket
- T1558.003 Kerberoasting
- T1558.004 AS-REP Roasting
- T1558.005 Ccache Files
Detection
- DET0522 Detect Kerberos Ticket Theft or Forgery (T1558)
Data components: Logon Session Metadata, Process Access, File Access, Active Directory Credential Request
Mitigations (6)
- M1015 Active Directory Configuration
For containing the impact of a previously generated golden ticket, reset the built-in KRBTGT account password twice, which will invalidate any existing golden tickets that have been created with the KRBTGT hash and other Kerberos tickets derived from it. For each domain, change the KRBTGT account password once, force replication, and then change the password a second time. Consider rotating the KRBTGT account password every 180 days.[1]
- M1026 Privileged Account Management
Limit domain admin account permissions to domain controllers and limited servers. Delegate other admin functions to separate accounts.
Limit service accounts to minimal required privileges, including membership in privileged groups such as Domain Administrators.[2]
- M1027 Password Policies
Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire.[2] Also consider using Group Managed Service Accounts or another third party product such as password vaulting.[2]
- M1041 Encrypt Sensitive Information
Enable AES Kerberos encryption (or another stronger encryption algorithm), rather than RC4, where possible.[2]
- M1043 Credential Access Protection
On Linux systems, protect resources with Security Enhanced Linux (SELinux) by defining entry points, process types, and file labels.[3]
- M1047 Audit
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
Groups (1)
References
- STIG krbtgt reset
- AdSecurity Cracking Kerberos Dec 2015
- Brining MimiKatz to Unix
- ADSecurity Kerberos Ring Decoder
- Microsoft Klist