Techniques › T1558
T1558 Steal or Forge Kerberos Tickets
credential access — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
6
Sigma rules tagged attack.t1558
3
KEV CVEs mapped here
<p>Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC). Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.</p><p>On Windows, the built-in <code>klist</code> utility can be used to list and analyze cached Kerberos tickets.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-13161 | Ivanti Endpoint Manager (EPM) | exploitation technique | Mapped | 2025-03-10 |
| CVE-2024-13160 | Ivanti Endpoint Manager (EPM) | exploitation technique | Mapped | 2025-03-10 |
| CVE-2024-13159 | Ivanti Endpoint Manager (EPM) | exploitation technique | Mapped | 2025-03-10 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0522 Detect Kerberos Ticket Theft or Forgery (T1558) v1.0
AN1443 WindowsDetects anomalous Kerberos activity such as forged or stolen tickets by correlating malformed fields in logon events, RC4-encrypted TGTs, or TGS requests without corresponding TGT requests. Also detects suspicious processes accessing LSASS memory for ticket extraction.Tunable:
TicketLifetimeThresholdEncryptionTypesProcessAllowlistAN1444 LinuxDetects suspicious access to SSSD secrets database and Kerberos key material indicating ticket theft or replay attempts. Correlates anomalous file access with unusual Kerberos service ticket requests.Tunable:SecretsAccessThresholdUnusualServiceAccountsAN1445 macOSDetects attempts to forge or replay Kerberos tickets by monitoring Unified Logs for anomalous kinit/klist activity and correlating unusual authentication sequences.macos:unifiedlogUnusual Kerberos TGS-REQ without TGT or anomalous ticket lifetime→ DC0088 Logon Session MetadataTunable:TicketRequestPatternsTicketLifetime
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1558
Author: frack113
· 2022-10-14 · logsource: product=windows service=security · 5a44727c-3b85-4713-8c44-4401d5499629
Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 78cc2dd2-7d20-4d32-93ff-057084c38b93
Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
Author: frack113
· 2022-10-14 (modified 2023-12-14) · logsource: product=windows service=security · 94309181-d345-4cbf-b5fe-061769bdf9cb
Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.
Author: Florian Roth (Nextron Systems), David ANDRE
· 2021-11-08 (modified 2024-06-27) · logsource: product=windows category=file_event · 9e099d99-44c2-42b6-a6d8-54c3545cab29
Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.
Author: frack113
· 2025-03-05 · logsource: product=windows category=ps_script · cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5
Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.
Author: Ilyas Ochkov, oscd.community
· 2019-10-24 (modified 2024-03-15) · logsource: product=windows category=network_connection · e54979bd-c5f9-4d6c-967b-a04b19ac4c74
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.