Pass the Ticket
Subtechnique · ATTACK:enterprise:T1550.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1550.003",
"title": "Pass the Ticket",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1550/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--7b211ac6-c815-4189-93a9-ab415deca926",
"external_id": "T1550.003",
"domain": "enterprise",
"created": "2020-01-30T17:03:43.072Z",
"modified": "2026-05-12T15:12:00.643Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"lateral-movement"
],
"source_references": [
{
"source_name": "Campbell 2014",
"url": "https://defcon.org/images/defcon-22/dc-22-presentations/Campbell/DEFCON-22-Christopher-Campbell-The-Secret-Life-of-Krbtgt.pdf"
},
{
"source_name": "GentilKiwi Pass the Ticket",
"url": "https://web.archive.org/web/20210515214027/https://blog.gentilkiwi.com/securite/mimikatz/pass-the-ticket-kerberos"
},
{
"source_name": "ADSecurity AD Kerberos Attacks",
"url": "https://adsecurity.org/?p=556"
},
{
"source_name": "Stealthbits Overpass-the-Hash",
"url": "https://stealthbits.com/blog/how-to-detect-overpass-the-hash-attacks/"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0053 → uses → ATTACK:enterprise:T1550.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02a7ea5c-695c-4932-9160-6e0441789670
Symantec Seaduke 2015ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1550.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0347a294-8928-4d15-8df2-44452b40afe4
ADSecurity AD Kerberos AttacksATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1550.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--214b91f3-a71f-45b2-b85a-b1510d947806
ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1550.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ff3969a-4992-43c0-b4dc-02a21f5c9b2b
ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1550.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5de21fc4-c460-4da4-9dc4-2acdd54640a8
Mandiant No Easy BreachATTACK:enterprise:T1550.003 → subtechnique-of → ATTACK:enterprise:T1550
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a387a6a-2359-4ea6-ab73-9428e188d408
ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1550.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76037b22-a3e4-40d3-bd56-699d1ea4e97e
AdSecurity Kerberos GT Aug 2015 · Adsecurity Mimikatz Guide · Harmj0y DCSync Sept 2015 · NCSC Joint Report Public ToolsATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1550.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--918a7d67-faea-4a41-9ed3-e3558fca73db
ADSecurity Kerberos and KRBTGT · STIG krbtgt resetATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1550.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f6c0951-1a78-4738-81ec-a11325a15352
GitHub PupyATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1550.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c08684c8-8467-4b7f-a9ac-3330cf423261
Cybereason Cobalt Kitty 2017ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1550.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb91c7d8-2cfb-4d8b-905a-d146bc8178e2
Secureworks BRONZE BUTLER Oct 2017