T1550.003 — Pass the Ticket

Tactic: Lateral Movement · Platforms: Windows

Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos…

Sub-technique of Use Alternate Authentication Material (T1550).

Sigma detection rules (1)

T1550.003 Use Alternate Authentication Material: Pass the Ticket

title: "T1550.003 Use Alternate Authentication Material: Pass the Ticket"
id: c0e356ea-0749-487b-a01e-eae483e8f62a
description: 'Detection Strategy for T1550.003 - Pass the Ticket, retargeted to Kerberos service-ticket requests (EventID 4769) using RC4-HMAC (0x17) encryption, a common downgrade artifact left by ticket-forging tooling. (Data Component: Logon Session Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, HostContextScope, LSASSAccessAnomalyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1550/003
author: Shahrukh Khan
date: 2026-05-16
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1550.003

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: '4769'
    TicketEncryptionType: '0x17'
  filter_system_account:
    TargetUserName|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  filter_machine_account:
    TargetUserName|endswith: '
    
  


  condition: selection and not 1 of filter_*

falsepositives:
  - Legacy applications/devices that only support RC4 Kerberos encryption.

level: medium

Related sub-techniques

Explore