Steal or Forge Kerberos Tickets: Silver Ticket
- ID
- T1558.002
- Tactics
- TA0006 Credential Access
- Sub-technique of
- T1558 Steal or Forge Kerberos Tickets
- Platforms
- Windows
- Data sources
- Logon Session Metadata, Active Directory Credential Request, Process Access
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.[2]
Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.[3]
Password hashes for target services may be obtained using OS Credential Dumping or Kerberoasting.
Detection
- DET0241 Detect Forged Kerberos Silver Tickets (T1558.002)
Data components: Logon Session Metadata, Active Directory Credential Request, Process Access
Mitigations (3)
- M1026 Privileged Account Management
Limit service accounts to minimal required privileges, including membership in privileged groups such as Domain Administrators.[1]
- M1027 Password Policies
Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire.[1] Also consider using Group Managed Service Accounts or another third party product such as password vaulting.[1]
- M1041 Encrypt Sensitive Information
Enable AES Kerberos encryption (or another stronger encryption algorithm), rather than RC4, where possible.[1]
Software (4)
References
- AdSecurity Cracking Kerberos Dec 2015
- ADSecurity Silver Tickets
- ADSecurity Detecting Forged Tickets