自动化接入 · API / MCP EN

技术说明 · T1558.001

Golden Ticket

Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket. Golden tickets enable adversaries to generate authentication material for any account in Active Directory. Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources. Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS. The KDC service runs all on domain controllers that are part of an Active Directory domain. KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets. The KRBTGT password hash may be obtained using OS Credential Dumping and privileged access to a domain controller.

ATT&CK T1558.001 platforms — 状态 有效 版本 20.1

Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.1 Golden tickets enable adversaries to generate authentication material for any account in Active Directory.2 Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources. Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.3 The KDC service runs all on domain controllers that are part of an Active Directory domain. KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets.4 The KRBTGT password hash may be obtained using OS Credential Dumping and privileged access to a domain controller.

  1. AdSecurity Kerberos GT Aug 2015
  2. CERT-EU Golden Ticket Protection
  3. ADSecurity Detecting Forged Tickets
  4. ADSecurity Kerberos and KRBTGT

使用该技术的组织

组织名称国家
grp_g0004Ke3chang—

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。