Skip to content

Golden Ticket

Subtechnique · ATTACK:enterprise:T1558.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1558.001",
  "title": "Golden Ticket",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1558/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--768dce68-8d0d-477a-b01d-0eea98b963a1",
  "external_id": "T1558.001",
  "domain": "enterprise",
  "created": "2020-02-11T19:13:33.643Z",
  "modified": "2025-10-24T17:48:58.155Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "AdSecurity Kerberos GT Aug 2015",
      "url": "https://adsecurity.org/?p=1640"
    },
    {
      "source_name": "CERT-EU Golden Ticket Protection",
      "url": "https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf"
    },
    {
      "source_name": "ADSecurity Detecting Forged Tickets",
      "url": "https://adsecurity.org/?p=1515"
    },
    {
      "source_name": "ADSecurity Kerberos and KRBTGT",
      "url": "https://adsecurity.org/?p=483"
    },
    {
      "source_name": "Stealthbits Detect PtT 2019",
      "url": "https://blog.stealthbits.com/detect-pass-the-ticket-attacks"
    },
    {
      "source_name": "Microsoft Kerberos Golden Ticket",
      "url": "https://gallery.technet.microsoft.com/scriptcenter/Kerberos-Golden-Ticket-b4814285"
    }
  ]
}

Explicit source assertions (8)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1558.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42049cfe-e374-4726-9832-3ad01d8466a5

NCC Group APT15 Alive and Strong

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1558.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7367c930-0727-4550-b421-2768edef03cd

Github PowerShell Empire

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1558.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b8254f2-bfbb-4775-aaf8-3b5fa3457ee9

GitHub Mimikatz kerberos Module · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1558.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6e6f751-5c93-4a31-afdc-78513aaea15a

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1558.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2efefa6-e1e8-4817-9e62-70ba100e9432

Cybereason Sliver Undated

ATTACK:enterprise:S1071 → uses → ATTACK:enterprise:T1558.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6b24dda-b98e-44d0-913c-cb1987eba799

GitHub Rubeus March 2023

ATTACK:enterprise:T1558.001 → subtechnique-of → ATTACK:enterprise:T1558

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6c52b80-6bbc-4a80-9455-40046356cb98

ATTACK:enterprise:M1015 → mitigates → ATTACK:enterprise:T1558.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6d6f916-ca2a-4c25-841f-02d71b31308c

STIG krbtgt reset

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.