CAPEC-645: Use of Captured Tickets (Pass The Ticket)
Description
An adversary uses stolen Kerberos tickets to access systems/resources that leverage the Kerberos authentication protocol. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. An adversary can obtain any one of these tickets (e.g. Service Ticket, Ticket Granting Ticket, Silver Ticket, or Golden Ticket) to authenticate to a system/resource without needing the account's credentials. Depending on the ticket obtained, the adversary may be able to access a particular resource or generate TGTs for any account within an Active Directory Domain.
- Likelihood of attack
- Low
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Subvert Access Control
Prerequisites
- The adversary needs physical access to the victim system.
- The use of a third-party credential harvesting tool.
Skills required
- LowDetermine if Kerberos authentication is used on the server.
- HighThe adversary uses a third-party tool to obtain the necessary tickets to execute the attack.
Consequences
- Integrity
Gain Privileges
Mitigations
- Reset the built-in KRBTGT account password twice to invalidate the existence of any current Golden Tickets and any tickets derived from them.
- Monitor system and domain logs for abnormal access.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-TBAToken-based Authentication1 shared
- D3-TBToken Binding1 shared
- D3-WSAMWeb Session Access Mediation1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared
- D3-HSHost Shutdown1 shared
- D3-KBPIKernel-based Process Isolation1 shared
- D3-PLAProcess Lineage Analysis1 shared
- D3-PSMDProcess Self-Modification Detection1 shared
- D3-PSProcess Suspension1 shared
- D3-PTProcess Termination1 shared
- D3-ANCIAuthentication Cache Invalidation1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.