Steal or Forge Kerberos Tickets
Technique · ATTACK:enterprise:T1558
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1558",
"title": "Steal or Forge Kerberos Tickets",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1558",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--3fc01293-ef5e-41c6-86ce-61f10706b64a",
"external_id": "T1558",
"domain": "enterprise",
"created": "2020-02-11T19:12:46.830Z",
"modified": "2026-05-12T15:12:00.628Z",
"version": "1.7",
"aliases": [
],
"tactics": [
"credential-access"
],
"source_references": [
{
"source_name": "CERT-EU Golden Ticket Protection",
"url": "https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf"
},
{
"source_name": "Microsoft Detecting Kerberoasting Feb 2018",
"url": "https://blogs.technet.microsoft.com/motiba/2018/02/23/detecting-kerberoasting-activity-using-azure-security-center/"
},
{
"source_name": "Medium Detecting Attempts to Steal Passwords from Memory",
"url": "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea"
},
{
"source_name": "Stealthbits Detect PtT 2019",
"url": "https://blog.stealthbits.com/detect-pass-the-ticket-attacks"
},
{
"source_name": "AdSecurity Cracking Kerberos Dec 2015",
"url": "https://adsecurity.org/?p=2293"
},
{
"source_name": "ADSecurity Detecting Forged Tickets",
"url": "https://adsecurity.org/?p=1515"
},
{
"source_name": "Microsoft Kerberos Golden Ticket",
"url": "https://gallery.technet.microsoft.com/scriptcenter/Kerberos-Golden-Ticket-b4814285"
},
{
"source_name": "Microsoft Klist",
"url": "https://docs.microsoft.com/windows-server/administration/windows-commands/klist"
},
{
"source_name": "ADSecurity Kerberos Ring Decoder",
"url": "https://adsecurity.org/?p=227"
}
]
}Explicit source assertions (13)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--037b851b-7ced-4322-a57a-9f744f9a1e76
STIG krbtgt resetATTACK:enterprise:M1043 → mitigates → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a1f2d06-9ea1-4ace-8d97-92bf4de60240
Brining MimiKatz to UnixATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c38121e-22b6-491c-95a6-f78c5bb090e2
CERT PolskaATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5574a01e-efcc-49d6-8692-30c97c611397
AdSecurity Cracking Kerberos Dec 2015ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5869cc87-316e-46ae-9f4f-fb6876b42d39
Cisco Akira Ransomware OCT 2024ATTACK:enterprise:T1558.003 → subtechnique-of → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--944b9cc3-95c7-4e0d-8b62-576aa6cf7217
ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb2238b0-bd8e-4b21-b692-d1f362c102b4
AdSecurity Cracking Kerberos Dec 2015ATTACK:enterprise:T1558.002 → subtechnique-of → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d607d79e-a3f0-4236-946c-e434068d008b
ATTACK:enterprise:T1558.005 → subtechnique-of → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5aea511-17b8-4bbc-8d7b-15db602a1099
ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1959153-4487-4604-a054-f2d7918c2067
ATTACK:enterprise:T1558.004 → subtechnique-of → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5fc2b7c-72d3-47be-8287-9608b6beb63d
ATTACK:enterprise:T1558.001 → subtechnique-of → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6c52b80-6bbc-4a80-9455-40046356cb98
ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1558
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbba8143-52be-4b81-8af7-94518799faaa
AdSecurity Cracking Kerberos Dec 2015