Steal or Forge Kerberos Tickets T1558
Tactic: Credential Access
Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC). Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.
Events covered
38 catalog events are tagged with this technique by at least one rule.
Authoring guide
These 98 rules share fields, values, and exclusions.
Fields filtered most (94 distinct)
These fields appear most often in rule filters.
Top indicator values (823 distinct)
These values appear most often in rule predicates.
Exclusions (197 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 35 rules
- Administrator login impersonation with forged Golden ticket
- Antivirus - Password Dumper Signature
- HackTool - KrbRelay Execution
- HackTool - KrbRelayUp Execution
- HackTool - Mimikatz Kirbi File Creation
- HackTool - RemoteKrbRelay Execution
- HackTool - Rubeus Execution
- HackTool - Rubeus Execution - ScriptBlock
- Kerberoast ticket request detected
- Kerberoasting Activity - Initial Query
- Kerberos AS-REP Roasting ticket request detected
- Kerberos key list attack for credential dumping
- Kerberos Network Traffic RC4 Ticket Encryption
- Kerberos TGS ticket request related to a potential Golden ticket
- Kerberos ticket without a trailing $ (CVE-2021-42278/42287)
- No Suitable Encryption Key Found For Generating Kerberos Ticket
- Potential AS-REP Roasting via Kerberos TGT Requests
- Potential CVE-2021-42278 Exploitation Attempt
- Potential CVE-2021-42287 Exploitation Attempt
- Potential SPN Enumeration Via Setspn.EXE
- Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock
- Register new Logon Process by Rubeus
- Replay Attack Detected
- Rubeus Kerberos constrained delegation abuse (S4U2Proxy)
- Rubeus Kerberos unconstrained delegation abuse
- Shared folder access with forged Golden ticket
- Suspicious Kerberos password account reset to issue potential Golden ticket
- Suspicious Kerberos proxiable/S4U2self ticket (CVE-2021-42278/42287)
- Suspicious Kerberos RC4 Ticket Encryption
- Suspicious Kerberos Ticket Request via CLI
- Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock
- Suspicious SPN enumeration previous to Kerberoasting attack (PowerShell)
- Uncommon Outbound Kerberos Connection
- Uncommon Outbound Kerberos Connection - Security
- User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'
Elastic 26 rules
- First Time Python Accessed Sensitive Credential Files
- Kerberos Cached Credentials Dumping
- Kerberos Pre-authentication Disabled for User
- Kerberos Traffic from Unusual Process
- Kirbi File Creation
- KRBTGT Delegation Backdoor
- LDAP Search followed by Kerberos Connection
- Newly Observed RC4 Kerberos Service Ticket Request
- PKINIT Followed by Same-Principal U2U Service Ticket
- Potential Access to Kerberos Cached Credentials
- Potential Credential Access via Mimikatz
- Potential Credential Access via Rubeus
- Potential Invoke-Mimikatz PowerShell Script
- Potential Kerberos Attack via Bifrost
- Potential Kerberos Attack via Bifrost
- Potential PowerShell HackTool Script by Function Names
- PowerShell Kerberos Ticket Dump
- PowerShell Kerberos Ticket Request
- Privilege Escalation via NTLMRelay2Self
- Sensitive Privilege SeEnableDelegationPrivilege assigned to a Principal
- Service Creation via Local Kerberos Authentication
- Suspicious Credential Files Creation via Kerberos
- Suspicious Kerberos Authentication Ticket Request
- Unusual Kerberos Client Process
- Unusual LDAP Client Process
- User account exposed to Kerberoasting
Splunk 27 rules
- Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
- Disabled Kerberos Pre-Authentication Discovery With PowerView
- Kerberoasting spn request with RC4 encryption
- Kerberos Pre-Authentication Flag Disabled in UserAccountControl
- Kerberos Pre-Authentication Flag Disabled with PowerShell
- Kerberos Service Ticket Request Using RC4 Encryption
- Kerberos Weak Encryption Methods (Windows Event Log)
- Mimikatz (Sysmon)
- Mimikatz (Windows Event Log)
- Powersploit SPN Enumeration (PowerShell)
- Rubeus Command Line Parameters
- Rubeus Commands (PowerShell)
- Rubeus Commands (Sysmon)
- Rubeus Commands (Windows Event Log)
- Rubeus Password Change (Windows Event Log)
- ServicePrincipalNames Discovery with PowerShell
- ServicePrincipalNames Discovery with SetSPN
- Unusual Number of Kerberos Service Tickets Requested
- Windows Computer Account Created by Computer Account
- Windows Computer Account Requesting Kerberos Ticket
- Windows Computer Account With SPN
- Windows Domain Admin Impersonation Indicator
- Windows Kerberos Local Successful Logon
- Windows PowerView Kerberos Service Ticket Request
- Windows PowerView SPN Discovery
- Windows Process With NetExec Command Line Parameters
- Windows Steal or Forge Kerberos Tickets Klist
Kusto 10 rules
- Alsid Golden Ticket
- Detect Potential Kerberoast Activities
- Pathlock TDnR - Kerberos Keytab Changes
- Potential Kerberoasting
- Powershell Empire Cmdlets Executed in Command Line
- Semperis DSP Kerberos krbtgt account with old password
- T1558.003 - Kerberoasting
- Tenable.ad Golden Ticket
- TIE Golden Ticket
- UnPAC the hash