domains / families / security / detecting-golden-ticket-attacks-in-kerberos-logs

detecting-golden-ticket-attacks-in-kerberos-logs

separate

Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries

When to use

• When KRBTGT account hash may have been compromised via DCSync or NTDS.dit extraction
• When hunting for forged Kerberos tickets used for persistent domain access
• After incident response reveals credential theft at the domain level
• When investigating impossible logon patterns (users logging in from multiple locations simultaneously)
• During post-breach assessment to determine if Golden Tickets are in use

Skill page

Source