Pass-the-Ticket: Kerberos ticket theft attack

Pass-the-Ticket is an attack technique targeting Kerberos authentication in Active Directory environments. It exploits stolen Kerberos tickets — either Ticket Granting Tickets (TGT) or Service Tickets (TGS) — to authenticate as a legitimate user without ever knowing their password. The attacker extracts ticket data directly from LSASS memory or from the file system (typically .kirbi files), then injects those tickets into a new logon session. Because Kerberos relies on ticket possession rather than password verification, a valid ticket alone is sufficient to gain access. This makes Pass-the-Ticket particularly effective for lateral movement across Windows domains. The technique bypasses NTLM-based controls entirely. It is closely related to Golden Ticket and Silver Ticket attacks, which forge tickets rather than steal them. TGT theft grants broad access to request any service ticket. TGS theft targets a specific service directly. Both variants allow an attacker to operate under a stolen identity for the ticket's entire validity period, which defaults to 10 hours for TGTs in most domain configurations.

Detecting Pass-the-Ticket requires monitoring Kerberos authentication anomalies at the domain controller level. Windows Event ID 4768 logs TGT requests, while Event ID 4769 captures TGS requests. Analysts should flag TGS requests that arrive without a preceding 4768 event from the same host, which indicates an injected ticket rather than a fresh authentication flow. Event ID 4624 with logon type 3 combined with unusual source IP addresses can also signal ticket injection. Tools such as Microsoft Defender for Identity (formerly Azure ATP) detect abnormal ticket usage patterns, including tickets used from unexpected IP addresses or workstations. SIEM rules correlating Kerberos traffic volume spikes against known user baselines help surface anomalies. On the endpoint, Sysmon Event ID 10 can capture suspicious LSASS memory access attempts by tools like Mimikatz or Rubeus. Hunting for processes opening LSASS with PROCESS_VM_READ privileges outside of known security agents is a high-confidence indicator. Network-level detection via Zeek or Suricata can flag Kerberos AS-REP or TGS-REP packets with unusually long ticket lifetimes or anomalous encryption types such as RC4-HMAC where AES256 is the domain standard.

On the Red Team side, Pass-the-Ticket is primarily executed using Mimikatz or Rubeus. With Mimikatz, the command 'sekurlsa::tickets /export' dumps all Kerberos tickets from LSASS memory as .kirbi files. The command 'kerberos::ptt ticket.kirbi' then injects the selected ticket into the current session. Rubeus offers a stealthier alternative with its 'dump' and 'ptt' modules, operating entirely in memory without touching disk. Attackers typically target high-privilege accounts such as domain admins or service accounts with broad delegation rights. From a hardening perspective, enabling Kerberos AES256 encryption and disabling RC4-HMAC reduces ticket portability between environments. Implementing Credential Guard on Windows 10 and Server 2016 and later isolates LSASS in a virtualization-based security enclave, blocking direct memory extraction. Reducing TGT lifetime below the default 10 hours limits the attack window. Privileged Access Workstations (PAWs) should be used for all administrative tasks to limit ticket exposure. Tiered administration models prevent lateral movement from tier-2 workstations to tier-0 domain controllers. Monitoring and restricting unconstrained Kerberos delegation is also critical, as it is a frequent precondition for ticket harvesting in real-world intrusions.