[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M74X9NDK3MSTS3C8PBYQ2Z1S":3,"skill-same:01M74X9NDK3MSTS3C8PBYQ2Z1S":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":35,"commitSha":36,"skillDirectory":5,"forksCount":14,"repositoryHtmlUrl":37,"repositoryHomepageUrl":6,"ownerHtmlUrl":38,"ownerBlogUrl":39,"ownerDescription":6,"updatedAt":40,"install":41,"resources":54},"01M74X9NDK3MSTS3C8PBYQ2Z1S","detecting-golden-ticket-attacks-in-kerberos-logs",null,"Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.","SamuelChien\u002Fmega-skills-collection","SamuelChien","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F4652114?v=4","01M74KK34WVHA0P5ZYSJRDDFMG","Samuel Chien","01M74KK35FQN1N9VZ9EPTH3P2S",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fdetecting-golden-ticket-attacks-in-kerberos-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fdetecting-golden-ticket-attacks-in-kerberos-logs\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: detecting-golden-ticket-attacks-in-kerberos-logs\ndescription: Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures in domain controller event logs.\ndomain: cybersecurity\nsubdomain: threat-hunting\ntags: [threat-hunting, golden-ticket, kerberos, active-directory, mitre-t1558-001, credential-abuse]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Detecting Golden Ticket Attacks in Kerberos Logs\n\n## When to Use\n\n- When KRBTGT account hash may have been compromised via DCSync or NTDS.dit extraction\n- When hunting for forged Kerberos tickets used for persistent domain access\n- After incident response reveals credential theft at the domain level\n- When investigating impossible logon patterns (users logging in from multiple locations simultaneously)\n- During post-breach assessment to determine if Golden Tickets are in use\n\n## Prerequisites\n\n- Windows Security Event IDs 4768, 4769, 4771 on domain controllers\n- Kerberos policy configuration knowledge (max ticket lifetime, encryption types)\n- Domain controller audit policy enabling Kerberos Service Ticket Operations\n- SIEM with ability to correlate Kerberos events across multiple DCs\n\n## Workflow\n\n1. **Monitor TGT Requests (Event 4768)**: Track Kerberos authentication service requests. Golden Tickets bypass the AS-REQ\u002FAS-REP exchange entirely, so the absence of 4768 before 4769 is suspicious.\n2. **Detect Encryption Type Anomalies**: Golden Tickets often use RC4 (0x17) encryption. If your domain enforces AES (0x12), any RC4 TGT is a red flag. Monitor TicketEncryptionType in Event 4769.\n3. **Check Ticket Lifetime Anomalies**: Default Kerberos TGT lifetime is 10 hours with 7-day renewal. Golden Tickets can be forged with 10-year lifetimes. Detect tickets with durations exceeding policy.\n4. **Hunt for Non-Existent SIDs**: Golden Tickets can include arbitrary SIDs (including non-existent accounts or groups). Correlate TGS requests against known AD SID inventory.\n5. **Detect TGS Without Prior TGT**: When a service ticket (4769) appears without a preceding TGT request (4768) from the same IP\u002Faccount, this may indicate a pre-existing Golden Ticket.\n6. **Monitor KRBTGT Password Age**: Track when KRBTGT was last reset. If KRBTGT hash hasn't changed since a known compromise, Golden Tickets from that period remain valid.\n7. **Validate PAC Signatures**: With KB5008380+ and PAC validation enforcement, domain controllers reject forged PACs. Monitor for Kerberos failures indicating PAC validation errors.\n\n## Detection Queries\n\n### Splunk -- RC4 Encryption in Kerberos TGS\n```spl\nindex=wineventlog EventCode=4769\n| where TicketEncryptionType=\"0x17\"\n| where ServiceName!=\"krbtgt\"\n| stats count by TargetUserName ServiceName IpAddress TicketEncryptionType Computer\n| where count > 5\n| sort -count\n```\n\n### Splunk -- TGS Without Prior TGT\n```spl\nindex=wineventlog (EventCode=4768 OR EventCode=4769)\n| stats earliest(_time) as first_tgt by TargetUserName IpAddress EventCode\n| eventstats earliest(eval(if(EventCode=4768, first_tgt, null()))) as tgt_time by TargetUserName IpAddress\n| where EventCode=4769 AND (isnull(tgt_time) OR first_tgt \u003C tgt_time)\n| table TargetUserName IpAddress first_tgt tgt_time\n```\n\n### KQL -- Golden Ticket Indicators\n```kql\nSecurityEvent\n| where EventID == 4769\n| where TicketEncryptionType == \"0x17\"\n| where ServiceName != \"krbtgt\"\n| summarize Count=count() by TargetUserName, IpAddress, ServiceName\n| where Count > 5\n```\n\n## Common Scenarios\n\n1. **Post-DCSync Golden Ticket**: After extracting KRBTGT hash, attacker forges TGT with Domain Admin SID, valid for months until KRBTGT is rotated twice.\n2. **RC4 Downgrade**: Golden Ticket forged with RC4 encryption in an AES-only environment, detectable by encryption type mismatch.\n3. **Cross-Domain Golden Ticket**: Forged inter-realm TGT used to pivot between AD domains\u002Fforests.\n4. **Persistence After Remediation**: Golden Tickets surviving password resets because KRBTGT was only rotated once (both current and previous hashes are valid).\n\n## Output Format\n\n```\nHunt ID: TH-GOLDEN-[DATE]-[SEQ]\nSuspected Account: [Account using forged ticket]\nSource IP: [Client IP]\nTarget Service: [SPN accessed]\nEncryption Type: [RC4\u002FAES128\u002FAES256]\nAnomaly: [No prior TGT\u002FRC4 in AES environment\u002FExtended lifetime]\nKRBTGT Last Reset: [Date]\nRisk Level: [Critical]\n```\n","# Detecting Golden Ticket Attacks in Kerberos Logs\n\n## When to Use\n\n- When KRBTGT account hash may have been compromised via DCSync or NTDS.dit extraction\n- When hunting for forged Kerberos tickets used for persistent domain access\n- After incident response reveals credential theft at the domain level\n- When investigating impossible logon patterns (users logging in from multiple locations simultaneously)\n- During post-breach assessment to determine if Golden Tickets are in use\n\n## Prerequisites\n\n- Windows Security Event IDs 4768, 4769, 4771 on domain controllers\n- Kerberos policy configuration knowledge (max ticket lifetime, encryption types)\n- Domain controller audit policy enabling Kerberos Service Ticket Operations\n- SIEM with ability to correlate Kerberos events across multiple DCs\n\n## Workflow\n\n1. **Monitor TGT Requests (Event 4768)**: Track Kerberos authentication service requests. Golden Tickets bypass the AS-REQ\u002FAS-REP exchange entirely, so the absence of 4768 before 4769 is suspicious.\n2. **Detect Encryption Type Anomalies**: Golden Tickets often use RC4 (0x17) encryption. If your domain enforces AES (0x12), any RC4 TGT is a red flag. Monitor TicketEncryptionType in Event 4769.\n3. **Check Ticket Lifetime Anomalies**: Default Kerberos TGT lifetime is 10 hours with 7-day renewal. Golden Tickets can be forged with 10-year lifetimes. Detect tickets with durations exceeding policy.\n4. **Hunt for Non-Existent SIDs**: Golden Tickets can include arbitrary SIDs (including non-existent accounts or groups). Correlate TGS requests against known AD SID inventory.\n5. **Detect TGS Without Prior TGT**: When a service ticket (4769) appears without a preceding TGT request (4768) from the same IP\u002Faccount, this may indicate a pre-existing Golden Ticket.\n6. **Monitor KRBTGT Password Age**: Track when KRBTGT was last reset. If KRBTGT hash hasn't changed since a known compromise, Golden Tickets from that period remain valid.\n7. **Validate PAC Signatures**: With KB5008380+ and PAC validation enforcement, domain controllers reject forged PACs. Monitor for Kerberos failures indicating PAC validation errors.\n\n## Detection Queries\n\n### Splunk -- RC4 Encryption in Kerberos TGS\n```spl\nindex=wineventlog EventCode=4769\n| where TicketEncryptionType=\"0x17\"\n| where ServiceName!=\"krbtgt\"\n| stats count by TargetUserName ServiceName IpAddress TicketEncryptionType Computer\n| where count > 5\n| sort -count\n```\n\n### Splunk -- TGS Without Prior TGT\n```spl\nindex=wineventlog (EventCode=4768 OR EventCode=4769)\n| stats earliest(_time) as first_tgt by TargetUserName IpAddress EventCode\n| eventstats earliest(eval(if(EventCode=4768, first_tgt, null()))) as tgt_time by TargetUserName IpAddress\n| where EventCode=4769 AND (isnull(tgt_time) OR first_tgt \u003C tgt_time)\n| table TargetUserName IpAddress first_tgt tgt_time\n```\n\n### KQL -- Golden Ticket Indicators\n```kql\nSecurityEvent\n| where EventID == 4769\n| where TicketEncryptionType == \"0x17\"\n| where ServiceName != \"krbtgt\"\n| summarize Count=count() by TargetUserName, IpAddress, ServiceName\n| where Count > 5\n```\n\n## Common Scenarios\n\n1. **Post-DCSync Golden Ticket**: After extracting KRBTGT hash, attacker forges TGT with Domain Admin SID, valid for months until KRBTGT is rotated twice.\n2. **RC4 Downgrade**: Golden Ticket forged with RC4 encryption in an AES-only environment, detectable by encryption type mismatch.\n3. **Cross-Domain Golden Ticket**: Forged inter-realm TGT used to pivot between AD domains\u002Fforests.\n4. **Persistence After Remediation**: Golden Tickets surviving password resets because KRBTGT was only rotated once (both current and previous hashes are valid).\n\n## Output Format\n\n```\nHunt ID: TH-GOLDEN-[DATE]-[SEQ]\nSuspected Account: [Account using forged ticket]\nSource IP: [Client IP]\nTarget Service: [SPN accessed]\nEncryption Type: [RC4\u002FAES128\u002FAES256]\nAnomaly: [No prior TGT\u002FRC4 in AES environment\u002FExtended lifetime]\nKRBTGT Last Reset: [Date]\nRisk Level: [Critical]\n```\n",{"name":5,"tags":25,"author":32,"domain":33,"license":15,"version":34,"subdomain":26,"description":7},[26,27,28,29,30,31],"threat-hunting","golden-ticket","kerberos","active-directory","mitre-t1558-001","credential-abuse","mahipal","cybersecurity","1.0","main","c2b1fdccc779e99ac814e55fb69ca8d71215dd0f","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection","https:\u002F\u002Fgithub.com\u002FSamuelChien","http:\u002F\u002Fsamuelchien.com\u002F","2026-05-26 08:27:14",{"source":8,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add SamuelChien\u002Fmega-skills-collection --skill detecting-golden-ticket-attacks-in-kerberos-logs",{"tool":47,"command":48},"bunx","bunx skills add SamuelChien\u002Fmega-skills-collection --skill detecting-golden-ticket-attacks-in-kerberos-logs",{"tool":50,"command":51},"pnpm","pnpm dlx skills add SamuelChien\u002Fmega-skills-collection --skill detecting-golden-ticket-attacks-in-kerberos-logs","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fdetecting-golden-ticket-attacks-in-kerberos-logs\u002FSKILL.md",true,[55,59,65],{"path":56,"resourceType":56,"resourceTypeDesc":57,"sizeBytes":58,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":60,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":63,"sourceHtmlUrl":64},"references\u002Fapi-reference.md","REFERENCE","参考文档",1679,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fdetecting-golden-ticket-attacks-in-kerberos-logs\u002Freferences\u002Fapi-reference.md",{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"scripts\u002Fagent.py","SCRIPT","脚本",6279,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fdetecting-golden-ticket-attacks-in-kerberos-logs\u002Fscripts\u002Fagent.py",[72,80,87,94,101,108],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":76,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":20},"01M76R4WZQZAXGGXMQCA0FZ716","zustand-store-ts","Create Zustand stores with TypeScript, subscribeWithSelector middleware, and proper state\u002Faction separation. Use when building React state management, creating global stores, or implementing reactive state patterns with Zustand.","MIT","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-ts\u002FSKILL.md",[],[],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":76,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":20},"01M76R4T9KENDH7FENGZQHBW4G","zustand-store-creator","Zustand Store Creator - Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":76,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":20},"01M76R3YWN84B7SANJ52X799ZE","zero-trust-config-helper","Zero Trust Config Helper - Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":76,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":20},"01M76R3HNSV2AEYSKHM915GJ58","zapier-integration-helper","Zapier Integration Helper - Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":20},"01M76R3DJSKAT4FA7DV4BF3GCE","zai-cli","Execute z.AI CLI providing vision, search, reader, and GitHub exploration via CLI and MCP.\nUse when user needs image\u002Fvideo analysis, OCR, UI-to-code conversion, error diagnosis,\nreal-time web search, web page to markdown extraction, or GitHub code exploration.\nTrigger with phrases like \"analyze this image\", \"search the web for\", \"read this page\",\n\"explore this repo\", or \"use zai\". Requires Z_AI_API_KEY.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzai-cli\u002FSKILL.md",[],[],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":76,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":20},"01M76R2KAM699XE9AJVAWE4H2E","yt-research","Research competitor YouTube channels, niches, and trending topics for your content strategy.\nUse this skill whenever the user says \"research channels\", \"analyze competitors\", \"find trending topics\",\n\"niche analysis\", \"competitive research\", \"what are other creators doing\", \"scrape YouTube channels\",\nor wants to understand the competitive landscape for a specific tool or topic area. Use when working with yt research. Trigger with 'yt', 'research'.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fyt-research\u002FSKILL.md",[],[]]