Applied Cybernetics Group
T1558 Steal or Forge Kerberos Tickets
- Technique
T1558- Tactics
- Credential Access
- Research, 90 days
- 1
- KEV CVEs mapped
- 3
- SigmaHQ rules
- 5
- Elastic, Splunk
- 23
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1558
MITRE description
Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC).(Citation: ADSecurity Kerberos Ring Decoder) Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. On Windows, the built-in <code>klist</code> utility can be used to list and analyze cached Kerberos tickets.(Citation: Microsoft Klist)
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-29Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Detection coverage
SigmaHQ community rules
- Antivirus - Password Dumper Signature (core)
- Replay Attack Detected (core)
- HackTool - Mimikatz Kirbi File Creation (core)
- Uncommon Outbound Kerberos Connection (core)
- Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock (core)
Elastic and Splunk rules
- Kerberos Cached Credentials Dumping (elastic)
- First Time Python Accessed Sensitive Credential Files (elastic)
- Potential Kerberos Attack via Bifrost (elastic)
- Kerberos Pre-authentication Disabled for User (elastic)
- Kerberos Traffic from Unusual Process (elastic)
- Newly Observed RC4 Kerberos Service Ticket Request (elastic)
- Kirbi File Creation (elastic)
- Potential Invoke-Mimikatz PowerShell Script (elastic)
- PKINIT Followed by Same-Principal U2U Service Ticket (elastic)
- PowerShell Kerberos Ticket Dump (elastic)
- PowerShell Kerberos Ticket Request (elastic)
- Sensitive Privilege SeEnableDelegationPrivilege assigned to a Principal (elastic)
- User account exposed to Kerberoasting (elastic)
- Potential PowerShell HackTool Script by Function Names (elastic)
- Suspicious Kerberos Authentication Ticket Request (elastic)
- KRBTGT Delegation Backdoor (elastic)
- Service Creation via Local Kerberos Authentication (elastic)
- Windows Computer Account Created by Computer Account (splunk)
- Windows Computer Account Requesting Kerberos Ticket (splunk)
- Windows Computer Account With SPN (splunk)
- Windows Domain Admin Impersonation Indicator (splunk)
- Windows Kerberos Local Successful Logon (splunk)
- Windows Steal or Forge Kerberos Tickets Klist (splunk)