What is it?
Pass-the-Ticket reuses a captured Kerberos ticket. A service ticket grants access to one service, while a ticket-granting ticket can request additional tickets within the victim account’s privileges.
How it works in plain English
Use this three-part model to understand the attack without memorizing a tool name.
The system accepts a credential, token, ticket, recovery decision, or identity assertion as proof of who the requester is.
The attacker obtains, guesses, forges, replays, or changes that authentication material.
Focus on how the identity was acquired, where it was used, what device and network context changed, and what happened immediately after success.
Worked example: how the sequence may look
A valid Kerberos TGT or service ticket.
Import the ticket into an attacker-controlled session.
4768 TGT, 4769 service-ticket, and 4624 Kerberos logon events.
Correlate 4768, 4769, and 4624 across accounts and systems.
If successful, the attacker may continue with Remote Services. This is a possibility, not a guaranteed next step.
This is a defensive learning scenario. Real incidents vary, and the listed outcome is only one possible path.
Why do attackers use it?
Authenticate without knowing or resetting the password.
Move laterally while appearing to use normal Kerberos.
Reuse high-value tickets captured from an endpoint.
Reach one service or broader resources through a stolen TGT.
Prerequisites
A valid Kerberos TGT or service ticket.
A session where the ticket can be imported or used.
Connectivity to the domain and target service.
An unexpired ticket suitable for the target.
Attack path possibilities
Attack chains are not fixed. These links show common possibilities to investigate before and after this behavior.
Credential material is extracted from the Windows security process.
T1558.003 KerberoastingKerberos service tickets are obtained and cracked offline to recover service-account passwords.
T1558.004 AS-REP RoastingKerberos responses for accounts without pre-authentication are captured for offline cracking.
T1558.002 Silver TicketA Kerberos service ticket is forged with a stolen service-account key.
RDP, SMB, SSH, WinRM, VNC, or similar services are used to access remote systems.
T1003.006 DCSyncDirectory replication rights are abused to request domain password data.
T1098 Account ManipulationExisting accounts are altered to preserve or increase access.
T1486 RansomwareFiles or systems are encrypted or disrupted for extortion.
Step-by-step attack flow
Compromise a domain-joined endpoint and extract tickets.
Inspect scope, owner, service, lifetime, and privileges.
Import the ticket into an attacker-controlled session.
Use a service ticket directly or a TGT to request new tickets.
Access remote services as the ticket owner.
MITRE ATT&CK mapping
ATT&CK is updated over time. Verify the live technique before operationalizing a detection.
Logs and artifacts
4768 TGT, 4769 service-ticket, and 4624 Kerberos logon events.
Ticket use without an expected preceding interactive logon.
Rare lifetime, encryption, account/device, or service combinations.
Credential access and suspicious process access on the source.
Realistic log examples
These records use realistic field names and formats but synthetic organizations, users, addresses, and identifiers. A single event is not proof; correlate time, identity, source, target, and the resulting action.
Kerberos service-ticket request; useful for roasting, ticket abuse, and unusual service access.
2026-07-16T14:25:10Z EventID=4769 Computer=DC01.corp.example
TargetUserName=analyst@CORP.EXAMPLE ServiceName=MSSQLSvc/sql01.corp.example:1433
IpAddress=10.24.18.77 IpPort=53110 TicketEncryptionType=0x17
TicketOptions=0x40810000 Status=0x0 TransmittedServices=-Correlate 4768, 4769, and 4624 across accounts and systems.
Cloud sign-in context including identity, application, source, result, device, and conditional access.
2026-07-16T14:24:51Z UserPrincipalName=j.singh@corp.example
AppDisplayName="Office 365 Exchange Online" IPAddress=203.0.113.48
ResultType=50126 ResultDescription="Invalid username or password"
ClientAppUsed=Browser ConditionalAccessStatus=notApplied
DeviceDetail.operatingSystem=Windows Location=SGAlert on privileged ticket use outside the normal admin tier.
Failed authentication; useful for guessing, spraying, exposed remote services, and account targeting.
2026-07-16T14:22:31Z EventID=4625 Computer=DC01.corp.example
TargetUserName=j.singh TargetDomainName=CORP LogonType=3
AuthenticationPackageName=NTLM WorkstationName=WKSTN-442
IpAddress=203.0.113.48 IpPort=51842
Status=0xC000006D SubStatus=0xC000006A FailureReason="Unknown user name or bad password"Find service access without expected TGT activity where visibility allows.
- Who or what identity acted?
- From which device, process, IP, or workload?
- What target and operation were involved?
- Did it fail, succeed, or change state?
- What correlated event happened immediately before and after?
Detection logic / SIEM queries
Correlate 4768, 4769, and 4624 across accounts and systems.
Alert on privileged ticket use outside the normal admin tier.
Find service access without expected TGT activity where visibility allows.
Hunt for ticket extraction or injection plus lateral movement.
SecurityEvent
| where EventID == 4769
| summarize Services=dcount(ServiceName), ServiceList=make_set(ServiceName, 25)
by Account, IpAddress, bin(TimeGenerated, 30m)
| where Services >= 8Mitigations
Protect credentials with Credential Guard and LSASS controls.
Use privileged access workstations and restrict high-value logons.
Isolate compromised hosts and invalidate sessions quickly.
Rotate affected secrets; handle KRBTGT separately if needed.
Segment services and enforce least privilege.
Real-world examples
Tickets stolen from administrator sessions are reused during AD lateral movement.
Mimikatz popularized ticket extraction and injection.
The technique is often paired with credential dumping and remote service access.
Common questions
01What makes Pass-the-Ticket possible?
A trust assumption fails: an identity, input, component, network message, user decision, or software relationship is accepted without enough verification.
02What should a defender collect first?
Start with logs closest to the decision point, then add identity, endpoint, network, and control-plane context.
03How should I study this attack?
Learn the concept, identify prerequisites, map observable steps, write a detection hypothesis, and validate it safely in a lab.