{"id":"T1550.003","name":"Pass the Ticket","url":"https://attack.mitre.org/techniques/T1550/003","tactics":["lateral-movement"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0352","stix_id":"x-mitre-detection-strategy--5f53739d-3a41-4f7e-a83d-219a0c64e7a1","name":"Detection Strategy for T1550.003 - Pass the Ticket (Windows)","url":"https://attack.mitre.org/detectionstrategies/DET0352","analytics":[{"id":"AN1000","stix_id":"x-mitre-analytic--54ffc701-eb6c-4e3e-8615-0c6f8b327a34","name":"Analytic 1000","description":"Detects unauthorized Kerberos ticket injection by correlating service ticket (TGS - 4769) requests with absent corresponding account logons (4624) and prior Ticket Granting Ticket (TGT - 4768) activity. Highlights anomalous service ticket generation chains involving unexpected users, hosts, or times, and suspicious injection of tickets via mimikatz-like tooling into LSASS memory. Behavior also includes network lateral movement using Kerberos authentication absent expected interactive logon patterns.","url":"https://attack.mitre.org/detectionstrategies/DET0352#AN1000","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4769","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4768","data_component":"DC0084","data_component_name":"Active Directory Credential Request","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Defines the correlation window between TGT request (4768) and TGS request (4769)"},{"field":"HostContextScope","description":"Adjusts the host scoping for correlation of authentication chains and ticket injection"},{"field":"LSASSAccessAnomalyThreshold","description":"Allows tuning of alerts for ticket injection attempts via LSASS memory access"}],"live":true,"detection_strategies":["DET0352"],"techniques":["T1550.003"]}],"live":true,"version":"1.0","techniques":["T1550.003"]}],"sigma_rules":[{"id":"12827a56-61a4-476a-a9cb-f3068f191073","title":"HackTool - KrbRelayUp Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-04-26","modified":"2023-02-04","description":"Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced","references":["https://github.com/Dec0ne/KrbRelayUp"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1558.003","attack.lateral-movement","attack.t1550.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_krbrelayup.yml","techniques":["T1558.003","T1550.003"],"cves":[]},{"id":"3245cd30-e015-40ff-a31d-5cadd5f377ec","title":"HackTool - Rubeus Execution - ScriptBlock","author":"Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2023-04-27","modified":null,"description":"Detects the execution of the hacktool Rubeus using specific command line flags","references":["https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus","https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html","https://github.com/GhostPack/Rubeus"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.t1003","attack.t1558.003","attack.lateral-movement","attack.t1550.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml","techniques":["T1003","T1558.003","T1550.003"],"cves":[]},{"id":"7ec2c172-dceb-4c10-92c9-87c1881b7e18","title":"HackTool - Rubeus Execution","author":"Florian Roth (Nextron Systems)","status":"stable","level":"critical","date":"2018-12-19","modified":"2023-04-20","description":"Detects the execution of the hacktool Rubeus via PE information of command line parameters","references":["https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus","https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html","https://github.com/GhostPack/Rubeus"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.t1003","attack.t1558.003","attack.lateral-movement","attack.t1550.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_rubeus.yml","techniques":["T1003","T1558.003","T1550.003"],"cves":[]},{"id":"9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523","title":"DC Machine Account TGT Request from Non-DC Source IP","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-07-29","modified":null,"description":"Detects a Kerberos TGT request (Event 4768) for a known Domain Controller machine account\noriginating from an IP address that is not a known Domain Controller. DC machine accounts\nshould only request TGTs from their own IP. Any TGT request for a DC account from a\nworkstation or non-DC host is anomalous and indicates one of the following:\n\n  - PKINIT abuse (CVE-2026-54121 / Certighost): attacker authenticating as a DC via a\n    forged certificate from their workstation\n  - Overpass-the-Hash: attacker converting a stolen DC machine account NTLM hash into a\n    Kerberos TGT\n  - Pass-the-Hash (RC4): attacker using the DC machine account hash directly with Kerberos\n","references":["https://github.com/aniqfakhrul/CVE-2026-54121","https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.lateral-movement","attack.t1649","attack.t1550.003","attack.t1558.001","cve.2026-54121"],"path":"rules-placeholder/windows/builtin/security/win_security_dc_machine_accoutn_tgt_non_dc_ip.yml","techniques":["T1649","T1550.003","T1558.001"],"cves":["CVE-2026-54121"]},{"id":"b2e4a719-3c8f-4d1b-a507-f83c2d56e901","title":"DC Machine Account Network Logon from Non-DC Source IP","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"critical","date":"2026-07-29","modified":null,"description":"Detects a Domain Controller machine account authenticating from a source IP that is not\na known Domain Controller. DC machine accounts should only authenticate locally or from other DCs during\nreplication operations. Any logon event for a DC account from a workstation or non-DC host is anomalous and\nindicates one of the following:\n\n  - Silver Ticket: attacker forged a Kerberos TGS for a DC machine account without\n    requesting a TGT\n  - Pass-the-Ticket: attacker is replaying a captured DC machine account TGS from\n    a non-DC host\n  - Overpass-the-Hash: attacker converted a stolen DC machine account hash into a\n    Kerberos ticket and is authenticating from a non-DC host\n  - Exploitation of certain vulnerabilities such as CVE-2026-54121 (Certighost):\n    attacker obtained a DC certificate via ADCS CDC-chase\n    abuse, authenticates via PKINIT as the DC from their own host, then performs DCSync\n","references":["https://github.com/aniqfakhrul/CVE-2026-54121"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.lateral-movement","attack.t1550.003","attack.t1558.002","attack.t1649","cve.2026-54121"],"path":"rules-placeholder/windows/builtin/security/win_security_dc_machine_account_logon_non_dc_ip.yml","techniques":["T1550.003","T1558.002","T1649"],"cves":["CVE-2026-54121"]},{"id":"e3f7c841-2a9d-4b5e-c018-d94b3e67f012","title":"DC Machine Account TGS Request from Non-DC Source IP","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-07-29","modified":null,"description":"Detects a Kerberos service ticket request (Event 4769) targeting a Domain Controller\nmachine account's service (e.g. DRSUAPI) originating from an IP address that is not a\nknown Domain Controller. Service tickets for DC machine accounts should only be requested\nby other DCs during legitimate replication operations.\n\nAn attacker with a valid TGT (obtained via PKINIT, overpass-the-hash, or stolen TGT)\ntargeting a DC machine account's service from a workstation IP indicates preparation for\nDCSync or impersonation of a DC. Unlike Silver Ticket attacks (which forge the TGS and\nbypass this event), this rule catches attacks that go through the KDC legitimately.\n\nThis rule requires %dc_machine_accounts% and %dc_ip_addresses% to be populated with\nall known DC machine account names and DC IP addresses respectively.\n","references":["https://github.com/aniqfakhrul/CVE-2026-54121","https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54121","https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.lateral-movement","attack.t1550.003","attack.t1558.003","cve.2026-54121"],"path":"rules-placeholder/windows/builtin/security/win_security_dc_machine_account_tgs_non_dc_ip.yml","techniques":["T1550.003","T1558.003"],"cves":["CVE-2026-54121"]},{"id":"e54979bd-c5f9-4d6c-967b-a04b19ac4c74","title":"Uncommon Outbound Kerberos Connection","author":"Ilyas Ochkov, oscd.community","status":"test","level":"medium","date":"2019-10-24","modified":"2024-03-15","description":"Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.\n","references":["https://github.com/GhostPack/Rubeus"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.credential-access","attack.t1558","attack.lateral-movement","attack.t1550.003"],"path":"rules/windows/network_connection/net_connection_win_susp_outbound_kerberos_connection.yml","techniques":["T1558","T1550.003"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}