Techniques › T1558.001 › AN0405
AN0405 Analytic 0405
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects forged Kerberos Golden Tickets by correlating anomalous Kerberos ticket lifetimes, unexpected encryption types (e.g., RC4 in modern domains), malformed fields in logon/logoff events, and TGS requests without preceding TGT requests. Also monitors for abnormal patterns of access associated with elevated privileges across multiple systems.</p>
- Detects
- T1558.001 Golden Ticket
- Part of
- DET0144 Detect Forged Kerberos Golden Tickets (T1558.001)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4672, 4634 | DC0088 Logon Session Metadata |
| WinEventLog:Security | EventCode=4769 | DC0084 Active Directory Credential Request |
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TicketLifetimeThreshold | Kerberos TGT ticket lifetime exceeding default domain duration; tunable to environment-specific policies. |
AllowedEncryptionTypes | Valid encryption algorithms for Kerberos tickets; anomalies (e.g., RC4) may indicate forgery. |
PrivilegedAccountPatterns | Baseline of privileged accounts expected to perform Kerberos operations; deviations indicate suspicious activity. |
ProcessAllowlist | Expected processes interacting with lsass.exe; deviations may indicate credential dumping. |