T1558.002 — Silver Ticket

Tactic: Credential Access · Platforms: Windows

Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets. Silver tickets are more limited in scope in than golden…

Sub-technique of Steal or Forge Kerberos Tickets (T1558).

Sigma detection rules (1)

T1558.002 Steal or Forge Kerberos Tickets: Silver Ticket

title: "T1558.002 Steal or Forge Kerberos Tickets: Silver Ticket"
id: cc15b392-78fc-4316-b29f-a41934f9b758
description: 'Silver Ticket forgery is offline and leaves no direct artifact; proxies via Kerberos ticket requests (4769) for high-value SPNs using RC4-HMAC downgrade. (Data Component: Kerberos Ticket Request; baseline tier: windows-eventid.) Tune using: ServiceAccountScope, TicketValidationBaseline, ProcessAllowlist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1558/002
author: Shahrukh Khan
date: 2026-05-06
license: MIT
tags:
  - attack.credential-access
  - attack.t1558.002

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 4769
    TicketEncryptionType: '0x17'
    ServiceName|contains:
      - 'MSSQLSvc'
      - 'HTTP'
      - 'CIFS'
      - 'HOST'
      - 'LDAP'
  condition: selection

falsepositives:
  - Legacy applications/service accounts still using RC4 tickets by design.

level: medium

Related sub-techniques

Explore