Learn what Mimikatz is, how it works, and how to detect and defend against its attacks. Protect your network from credential theft and lateral movement.
What Is a Golden Ticket Attack?
Summarize This PageOn This Page
Summarize This PageOn This Page
FAQs about golden ticket attacks in Kerberos Authentication
A golden ticket is basically a hacker’s all-access pass to your Active Directory environment. It’s a forged Kerberos Ticket Granting Ticket (TGT), created using the krbtgt account hash (yep, the one that signs all the tickets in your domain). With this, attackers can impersonate anyone in the domain, including domain admins, and get unrestricted, long-lasting access to your network.
Here’s the gist of it:
First, the attacker grabs Domain Admin privileges or the krbtgt NTLM hash.
Then, they use a tool like Mimikatz to whip up a fake TGT.
Once created, they authenticate to any service in the domain using the forged ticket.
What makes this attack so sneaky? It skips over traditional login processes, making it tough to detect. Plus, attackers can customize these tickets with fake usernames or super extended lifespans for stealthy, ongoing access.
The krbtgt account is the MVP of Kerberos authentication. This built-in service account in Active Directory is used by the Key Distribution Center (KDC) to sign and encrypt TGTs. Here’s why it’s a big deal:
If attackers crack the krbtgt hash, they can sign their own TGTs, effectively becoming anyone in the domain.
To keep it safe, you’ve got to guard this credential like your IT life depends on it (because it kind of does).
Golden ticket attacks are the ninjas of the cyberattack world, but you can still catch them with the right moves. Detection methods include:
Checking for Kerberos TGTs that don’t have a matching AS-REQ (those should set off alarms).
Watching for ticket lifetimes that look off, or usernames that don’t actually exist.
Monitoring log activity for unusual patterns across Event IDs 4768, 4769, 4770, and 4771.
Using tools like Splunk, Microsoft Sentinel, or Defender for Identity to analyze behavior.
Getting alerts when privileged activity pops up on suspicious devices.
The go-to tool for golden ticket attacks? Mimikatz. This post-exploitation favorite can snatch hashes and craft fake tickets like a pro. Other heavy-hitters include:
Impacket
Rubeus
Empire
Attackers and red teamers alike use these tools to forge tickets and simulate real-world attacks.
Here’s how to take the golden ticket out of attackers’ hands:
Rotate your krbtgt account password regularly (and do it twice in a row to be extra safe).
Cut down on Domain Admin privileges and switch to a tiered administration model.
Activate protections like Credential Guard, LSASS protection, and disable WDigest.
Keep a close eye on unauthorized access attempts to domain controllers and LSASS memory.
Train your blue team to detect Kerberos persistence tricks.
Set up detection rules in SIEM and perform regular privileged access audits.
Want to keep golden ticket attackers out? Start implementing these changes now and stay one step ahead of the game.
Additional Resources
- Read more about What is Mimikatz? The Credential Dumping Tool You Should Know
- Read more about What Is a Watering Hole Attack? How Hackers StrikeLearn how watering hole attacks exploit trusted websites, how they work, and ways to detect and prevent these stealthy cyberattacks.
- Read more about What is Kerberos? A Guide to Secure AuthenticationLearn how Kerberos works and why it’s essential for secure enterprise authentication strategies. Explore features, uses, and best practices.
- Read more about What is Lateral Movement? Tactics, Detection & PreventionLearn how lateral movement allows attackers to navigate your network undetected. Discover common techniques like Pass-the-Hash, how to detect "east-west" traffic, and 5 proven prevention strategies to stop breaches.
- Read more about What's Active Directory Auditing in Cybersecurity?Learn what Active Directory auditing is, the auditor’s role, and why AD audits matter for cybersecurity. Learn what to monitor and best practices.
- Read more about What Are Outbound Phishing Attacks? (And Why They're So Bad)Learn what an outbound phishing attack is, how it works, and why it's a critical sign that your organization is compromised.
- Read more about What is a Domain Admin Group? Best Cybersecurity PracticesLearn about domain admin groups, their role in Windows Active Directory, and best practices to tighten cybersecurity and prevent unauthorized access.
- Read more about Exploiting PunycodeLearn what Punycode is, how cybercriminals exploit it for phishing, and the best defenses against homograph attacks in this 5-minute guide for cybersecurity pros.
- Read more about Active Directory Explained | Key Benefits of Active DirectoryLearn what Active Directory is, its architecture, security benefits, and best practices for all organizations in this all-in-one guide.
