<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-golden-ticket-attacks
description: >-
  Detect Kerberos Golden Ticket attacks through TGT anomaly analysis, KRBTGT
  account monitoring, event log correlation, and Active Directory forensics
  using Mimikatz artifact detection and ticket lifetime analysis.
domain: cybersecurity
subdomain: identity-access-management
tags:
  - golden-ticket
  - kerberos
  - active-directory
  - mimikatz
  - krbtgt
  - bloodhound
  - detection-engineering
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1558.001"]
---

# Detecting Golden Ticket Attacks

## Overview

A Golden Ticket attack forges Kerberos Ticket-Granting Tickets (TGTs) using the
KRBTGT account's password hash, granting the attacker domain-wide access with arbitrary
lifetimes and group memberships. Detection focuses on TGT anomalies — tickets with
lifetimes exceeding domain policy, missing corresponding AS-REQ events, forged PAC
data, and KRBTGT password age analysis.

Mode: `[MODE: PURPLE]` — Offensive technique mapped to defensive detection.

MITRE ATT&CK: T1558.001 (Steal or Forge Kerberos Tickets: Golden Ticket)

## Prerequisites

- Domain Controller event logs (4768, 4769, 4770, 4771)
- Advanced Audit Policy: Audit Kerberos Authentication Service, Audit Kerberos Service Ticket Operations
- SIEM with Windows Security event ingestion
- Python 3.10+ with `impacket`, `ldap3`
- BloodHound for AD graph analysis

## Key Concepts

### Golden Ticket Attack Chain

```
1. Compromise Domain Admin or DC
2. Extract KRBTGT hash: mimikatz "lsadump::dcsync /user:krbtgt"
3. Forge TGT: mimikatz "kerberos::golden /user:fakeadmin /domain:target.com /sid:S-1-5-21-... /krbtgt:HASH /id:500"
4. Inject ticket: mimikatz "kerberos::ptt ticket.kirbi"
5. Access any resource as any user in the domain
```

### Detection Indicators

| Indicator | Event ID | Description |
|-----------|----------|-------------|
| TGT with non-standard lifetime | 4768 | Ticket lifetime > domain policy (default 10 hrs) |
| TGS without prior TGT | 4769 | Service ticket request with no matching 4768 |
| KRBTGT hash extraction | 4662 | DCSync replication of KRBTGT object |
| Account not in AD | 4768 | TGT for nonexistent username |
| Forged PAC | N/A | Group memberships not matching AD |
| Encryption downgrade | 4768 | RC4 when domain supports AES |

### Sigma Detection Rules

```yaml
title: Golden Ticket — TGT with Anomalous Lifetime
id: e7f6a5b4-5678-9012-defg-h12345678901
status: experimental
description: Detects TGT requests with ticket lifetime exceeding domain MaxTicketAge
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4768
    Status: '0x0'
  filter_lifetime:
    TicketOptions: '0x40810010'
  condition: selection
falsepositives:
  - Misconfigured Kerberos policy
level: high
tags:
  - attack.t1558.001
  - attack.credential_access
```

```yaml
title: KRBTGT Account DCSync Replication
id: f8a7b6c5-6789-0123-efgh-i23456789012
status: experimental
description: Detects replication of KRBTGT account via DCSync
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectType: '%{19195a5b-6da0-11d0-afd3-00c04fd930c9}%'
    Properties: '*krbtgt*'
  condition: selection
falsepositives:
  - Legitimate domain controller replication
level: critical
tags:
  - attack.t1003.006
  - attack.credential_access
```

### Splunk Detection

```spl
# Golden Ticket — TGS without prior TGT
index=wineventlog EventCode=4769
| join TargetUserName [search index=wineventlog EventCode=4768
  | rename TargetUserName as TargetUserName
  | table TargetUserName _time]
| where isnull(_time)
| table _time TargetUserName ServiceName IpAddress

# DCSync detection
index=wineventlog EventCode=4662
  ObjectType="*19195a5b-6da0-11d0-afd3-00c04fd930c9*"
| where NOT match(SubjectUserName, "\$$")
| stats count by SubjectUserName ObjectName IpAddress
```

## Workflow

### Step 1: Verify KRBTGT Status

```bash
# Check KRBTGT password age
node scripts/agent.js --domain target.com --check-krbtgt

# PowerShell: Check KRBTGT last password set
Get-ADUser krbtgt -Properties PasswordLastSet | Select-Object PasswordLastSet
```

### Step 2: Analyze Event Logs

```bash
# Export Kerberos events
wevtutil qe Security /q:"*[System[(EventID=4768 or EventID=4769)]]" /f:json > /tmp/kerberos_events.json

# Run detection analysis
node scripts/agent.js --input /tmp/kerberos_events.json --output /tmp/golden_ticket_findings.json
```

### Step 3: Hunt with BloodHound

```bash
# Collect AD data
bloodhound-python -d target.com -u user -p 'password' -c All -ns DC_IP

# Import to BloodHound and query:
# MATCH (u:User)-[:MemberOf*1..]->(g:Group {name:'DOMAIN ADMINS@TARGET.COM'}) RETURN u
```

### Step 4: Remediate

```powershell
# Reset KRBTGT password TWICE (with 12+ hour gap)
# First reset
Set-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString "NewPass1!" -AsPlainText -Force)
# Wait 12 hours, then second reset
Set-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString "NewPass2!" -AsPlainText -Force)
```

## Verification

- [ ] KRBTGT password rotated within last 180 days
- [ ] Advanced audit policy enables Kerberos event logging (4768, 4769, 4662)
- [ ] SIEM alerts on TGT anomalies (lifetime, encryption, nonexistent users)
- [ ] DCSync detection rule deployed and tested
- [ ] No service accounts with Domain Admin membership
- [ ] BloodHound analysis shows no unnecessary paths to KRBTGT
- [ ] AES encryption enforced for Kerberos (RC4 disabled)

## References

- [MITRE ATT&CK T1558.001](https://attack.mitre.org/techniques/T1558/001/)
- [Microsoft — Detecting Golden Ticket Attacks](https://learn.microsoft.com/en-us/defender-for-identity/compromised-credentials-alerts)
- [ADSecurity.org — Golden Ticket Detection](https://adsecurity.org/?p=1640)
- [BloodHound](https://github.com/BloodHoundAD/BloodHound)
