T1558.001 — Golden Ticket

Tactic: Credential Access · Platforms: Windows

Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket. Golden tickets enable adversaries to generate authentication material for any account in Active Directory. Using a golden ticket, adversaries are then able to…

Sub-technique of Steal or Forge Kerberos Tickets (T1558).

Sigma detection rules (1)

T1558.001 Steal or Forge Kerberos Tickets: Golden Ticket

title: "T1558.001 Steal or Forge Kerberos Tickets: Golden Ticket"
id: d40fbe72-ab0f-4c86-80bd-833d0f22e3ba
description: 'Detects Kerberos service ticket requests (4769) using RC4-HMAC (0x17) for non-krbtgt services, a downgrade artifact seen with forged Golden Tickets. (Data Component: Kerberos Ticket Request; baseline tier: windows-eventid.) Tune using: TicketLifetimeThreshold, AllowedEncryptionTypes, PrivilegedAccountPatterns, ProcessAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1558/001
author: Shahrukh Khan
date: 2026-05-04
license: MIT
tags:
  - attack.credential-access
  - attack.t1558.001

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 4769
    TicketEncryptionType: '0x17'
  filter_krbtgt:
    ServiceName: 'krbtgt'
  condition: selection and not filter_krbtgt

falsepositives:
  - Legacy systems/printers/apps without AES support.

level: medium

Related sub-techniques

Explore