Golden Ticket: Kerberos TGT Forgery Attack

A Golden Ticket is a forged Kerberos Ticket Granting Ticket (TGT) crafted using the KRBTGT account's NTLM hash extracted from a domain controller. The Kerberos TGT Forgery Attack exploits the way Active Directory trusts any TGT encrypted with the KRBTGT secret. Because the Key Distribution Center (KDC) cannot distinguish a legitimate TGT from a forged one sharing the same encryption key, an attacker who holds the KRBTGT hash gains unrestricted, persistent access to every resource in the domain. The forged ticket can be set with an arbitrary lifetime, often 10 years, bypassing standard expiration controls. It can also impersonate any user, including non-existent accounts, with any group membership, including Domain Admins. This makes Golden Ticket attacks one of the most severe persistence techniques in Active Directory environments. The technique was popularized by Benjamin Delpy through Mimikatz and remains a primary post-exploitation objective in Red Team engagements targeting Windows domains.

Detecting Golden Ticket attacks on the Blue Team side requires careful correlation of Kerberos event logs on domain controllers. Event ID 4768 (TGT request) and 4769 (TGS request) are central to detection. Key anomalies include TGTs with lifetimes exceeding the domain policy maximum, typically flagged when the ticket encryption type is RC4-HMAC (type 0x17) rather than AES256, since Mimikatz historically defaults to RC4. Event ID 4672 (special privileges assigned) combined with logons from accounts that do not appear in Active Directory is a strong indicator. SIEMs like Microsoft Sentinel and Splunk can correlate these events across time. Behavioural baselines help identify accounts accessing an unusual number of services immediately after ticket creation. Network-level detection via tools like Zeek can inspect Kerberos traffic for anomalous PAC (Privilege Attribute Certificate) fields or oversized tickets. Monitoring for LSASS memory access (Event ID 10 in Sysmon) and credential dumping tools on domain controllers remains essential, as KRBTGT hash extraction is a prerequisite for the attack.

On the Red Team side, executing a Golden Ticket attack requires prior Domain Admin-level access to dump the KRBTGT hash using tools such as Mimikatz ('lsadump::dcsync /user:krbtgt') or Impacket's secretsdump.py. The forged TGT is then generated with Mimikatz ('kerberos::golden') specifying the domain SID, target username, KRBTGT NTLM hash, and desired group RIDs. The resulting ticket is injected into memory with 'kerberos::ptt', enabling lateral movement without re-authentication. The critical defensive countermeasure is rotating the KRBTGT password twice in succession, since a single rotation does not invalidate existing forged tickets. Microsoft's KRBTGT Reset Script automates this process safely. Enabling AES256 encryption and disabling RC4 for Kerberos reduces the attack surface. Tiered administration models and Privileged Access Workstations (PAWs) limit the blast radius by preventing credential exposure on domain controllers. Protected Users security group membership enforces AES-only authentication and prevents TGT caching, adding another layer of mitigation against persistence through forged tickets.