{"id":"T1558","name":"Steal or Forge Kerberos Tickets","url":"https://attack.mitre.org/techniques/T1558","tactics":["credential-access"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0522","stix_id":"x-mitre-detection-strategy--3638f523-dc38-4ff0-8682-d2027af5bd77","name":"Detect Kerberos Ticket Theft or Forgery (T1558)","url":"https://attack.mitre.org/detectionstrategies/DET0522","analytics":[{"id":"AN1443","stix_id":"x-mitre-analytic--685b05a6-92a3-417d-a917-8e7689e43237","name":"Analytic 1443","description":"Detects anomalous Kerberos activity such as forged or stolen tickets by correlating malformed fields in logon events, RC4-encrypted TGTs, or TGS requests without corresponding TGT requests. Also detects suspicious processes accessing LSASS memory for ticket extraction.","url":"https://attack.mitre.org/detectionstrategies/DET0522#AN1443","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4672, 4634","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TicketLifetimeThreshold","description":"Threshold for Kerberos TGT lifetimes deviating from domain defaults."},{"field":"EncryptionTypes","description":"Monitor for downgraded encryption types (e.g., RC4) in Kerberos tickets."},{"field":"ProcessAllowlist","description":"List of expected processes accessing LSASS; deviations may be suspicious."}],"live":true,"detection_strategies":["DET0522"],"techniques":["T1558"]},{"id":"AN1444","stix_id":"x-mitre-analytic--c101374a-ce7a-46d7-b7d4-c64fbdf1f685","name":"Analytic 1444","description":"Detects suspicious access to SSSD secrets database and Kerberos key material indicating ticket theft or replay attempts. Correlates anomalous file access with unusual Kerberos service ticket requests.","url":"https://attack.mitre.org/detectionstrategies/DET0522#AN1444","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"Access to /var/lib/sss/secrets/secrets.ldb or .secrets.mkey","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"Unusual kinit or klist activity","data_component":"DC0084","data_component_name":"Active Directory Credential Request","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"SecretsAccessThreshold","description":"Alert threshold for frequency of access to Kerberos secrets files."},{"field":"UnusualServiceAccounts","description":"Baseline accounts normally performing Kerberos requests; anomalies flagged."}],"live":true,"detection_strategies":["DET0522"],"techniques":["T1558"]},{"id":"AN1445","stix_id":"x-mitre-analytic--c08ad617-cc0d-4435-9168-08c762048503","name":"Analytic 1445","description":"Detects attempts to forge or replay Kerberos tickets by monitoring Unified Logs for anomalous kinit/klist activity and correlating unusual authentication sequences.","url":"https://attack.mitre.org/detectionstrategies/DET0522#AN1445","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Unusual Kerberos TGS-REQ without TGT or anomalous ticket lifetime","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"TicketRequestPatterns","description":"Expected sequence of TGT followed by TGS requests; deviations may indicate forgery."},{"field":"TicketLifetime","description":"Expected ticket lifetimes; anomalies may indicate Golden or Silver Tickets."}],"live":true,"detection_strategies":["DET0522"],"techniques":["T1558"]}],"live":true,"version":"1.0","techniques":["T1558"]}],"sigma_rules":[{"id":"5a44727c-3b85-4713-8c44-4401d5499629","title":"Replay Attack Detected","author":"frack113","status":"test","level":"high","date":"2022-10-14","modified":null,"description":"Detects possible Kerberos Replay Attack on the domain controllers when \"KRB_AP_ERR_REPEAT\" Kerberos response is sent to the client","references":["https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4649"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.t1558"],"path":"rules/windows/builtin/security/win_security_replay_attack_detected.yml","techniques":["T1558"],"cves":[]},{"id":"78cc2dd2-7d20-4d32-93ff-057084c38b93","title":"Antivirus - Password Dumper Signature","author":"Florian Roth (Nextron Systems), Arnim Rupp","status":"stable","level":"critical","date":"2018-09-09","modified":"2026-06-15","description":"Detects a highly relevant Antivirus alert that reports password dumpers and stealers.\nThis event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.\n","references":["https://www.nextron-systems.com/?s=antivirus","https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619","https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448"],"logsource":{"category":"antivirus"},"tags":["attack.credential-access","attack.t1003","attack.t1558","attack.t1003.001","attack.t1003.002"],"path":"rules/category/antivirus/av_password_dumper.yml","techniques":["T1003","T1558","T1003.001","T1003.002"],"cves":[]},{"id":"94309181-d345-4cbf-b5fe-061769bdf9cb","title":"User with Privileges Logon","author":"frack113","status":"test","level":"low","date":"2022-10-14","modified":"2023-12-14","description":"Detects logon with \"Special groups\" and \"Special Privileges\" can be thought of as Administrator groups or privileges.","references":["https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md","https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672","https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.credential-access","attack.t1558","attack.t1649","attack.t1550"],"path":"rules-placeholder/windows/builtin/security/win_security_admin_logon.yml","techniques":["T1558","T1649","T1550"],"cves":[]},{"id":"9e099d99-44c2-42b6-a6d8-54c3545cab29","title":"HackTool - Mimikatz Kirbi File Creation","author":"Florian Roth (Nextron Systems), David ANDRE","status":"test","level":"critical","date":"2021-11-08","modified":"2024-06-27","description":"Detects the creation of files created by mimikatz such as \".kirbi\", \"mimilsa.log\", etc.","references":["https://cobalt.io/blog/kerberoast-attack-techniques","https://pentestlab.blog/2019/10/21/persistence-security-support-provider/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.credential-access","attack.t1558"],"path":"rules/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml","techniques":["T1558"],"cves":[]},{"id":"cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5","title":"Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock","author":"frack113","status":"experimental","level":"medium","date":"2025-03-05","modified":null,"description":"Detects the use of the \"Get-ADComputer\" cmdlet in order to identify systems which are configured for unconstrained delegation.","references":["https://pentestlab.blog/2022/03/21/unconstrained-delegation/","https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.reconnaissance","attack.discovery","attack.credential-access","attack.t1018","attack.t1558","attack.t1589.002"],"path":"rules/windows/powershell/powershell_script/posh_ps_potential_unconstrained_delegation_discovery.yml","techniques":["T1018","T1558","T1589.002"],"cves":[]},{"id":"e54979bd-c5f9-4d6c-967b-a04b19ac4c74","title":"Uncommon Outbound Kerberos Connection","author":"Ilyas Ochkov, oscd.community","status":"test","level":"medium","date":"2019-10-24","modified":"2024-03-15","description":"Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.\n","references":["https://github.com/GhostPack/Rubeus"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.credential-access","attack.t1558","attack.lateral-movement","attack.t1550.003"],"path":"rules/windows/network_connection/net_connection_win_susp_outbound_kerberos_connection.yml","techniques":["T1558","T1550.003"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-13161","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-13160","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2024-13159","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}