Pass-the-ticket

Reusing stolen Kerberos TGT/TGS tickets

categoryIdentity, authentication and credential attacksseverityHighdetectabilityHighlabnot yet measured

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1550.003 · Mimikatz Kerberos Ticket Attack · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1550.003 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1550.003 -TestGuids dbf38128-7ba7-4776-bedf-cc2eed432098 -GetPrereqs; Invoke-AtomicTest T1550.003 -TestGuids dbf38128-7ba7-4776-bedf-cc2eed432098 -TimeoutSeconds 120'

Queued for lab measurement — not yet detonated. Expected to trip Wazuh 100222, 100240.

Classification

23 values: 8 reviewed, 10 imported, 5 derived. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	High
Resources required	Low
Likelihood / prevalence	Low
Maturity	Commoditized

Impact & scope

Severity	High
Impact	Integrity
Platform	Windows
Environment	On-premises
Target asset class	Identity
Kill-chain phase (tactic)	Lateral Movement

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Active Directory Credential RequestLogon Session CreationModule LoadProcess AccessUser Account Authentication
Defense bypassed	System access controls

Detection & response

Mitigated by 16

M1015 attack-mitigation
M1018 attack-mitigation
M1026 attack-mitigation
M1027 attack-mitigation
D3-ABPI d3fend
D3-HBPI d3fend
D3-HR d3fend
D3-HS d3fend
D3-KBPI d3fend
D3-PLA d3fend
D3-PS d3fend
D3-PSA d3fend
D3-PSMD d3fend
D3-PT d3fend
D3-SCF d3fend
D3-WSAM d3fend

Detected by 8

DET0352 attack-detection-strategy
12827a56-61a4-476a-a9cb-f3068f191073 sigma
3245cd30-e015-40ff-a31d-5cadd5f377ec sigma
7ec2c172-dceb-4c10-92c9-87c1881b7e18 sigma
9c5d2b84-1f7e-4a3c-d6b8-e04f9a17c523 sigma
b2e4a719-3c8f-4d1b-a507-f83c2d56e901 sigma
e3f7c841-2a9d-4b5e-c018-d94b3e67f012 sigma
e54979bd-c5f9-4d6c-967b-a04b19ac4c74 sigma

Tested by 2

a2fc4ec5-12c6-4fb4-b661-961f23f359cb atomic
dbf38128-7ba7-4776-bedf-cc2eed432098 atomic

Attack relationships

Parent: Primary Refresh Token (PRT) theft

Framework references

Primary source: https://attack.mitre.org/techniques/T1550/
attack: T1550.003 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 320 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 6 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)