Threat Hunting Exercise: Analyzing Windows Golden Ticket Attack Dataset
This hunt uses a simulated Windows Security/Sysmon dataset (windows_golden_ticket_2022-06-04T093000.json) capturing T1558.001: Golden Ticket, where an adversary who previously extracted the KRBTGT account hash forges a Kerberos TGT granting domain-admin-equivalent access to any resource, without needing to authenticate through a domain controller in the normal way.
Step 1: Hypothesis Formation
Hypothesis: A Kerberos TGS request (Event 4769) is observed for a ticket with an unusually long lifetime (default Golden Tickets are often forged with 10-year validity) or for a user account that does not exist in Active Directory, granting access to a resource, without a preceding legitimate TGT request (Event 4768) from that same session. Indicators:
- Security 4769: TGS request with ticket encryption type or lifetime inconsistent with domain Kerberos policy (e.g., RC4 when AES is enforced, or lifetime >> the configured max).
- Security 4768/4769 correlation gap: a 4769 exists with no matching prior 4768 from the same logon session - a ticket that was forged, not legitimately issued by the KDC.
- Username referenced in the ticket does not resolve to a valid, enabled AD account (a common Golden Ticket forging mistake/detection opportunity).
- Resulting access grants (4624 Logon Type 3) to high-value resources (DC, file servers) from a host with no prior admin relationship to those resources.
Null Hypothesis: A legitimate but misconfigured Kerberos policy (e.g., a service account with a non-standard ticket lifetime) is producing anomalous-looking 4769 events. Invalidate by checking Group Policy Kerberos settings and confirming the referenced account is valid, enabled, and has a documented long-lifetime exception.
Rationale: Golden Ticket attacks bypass normal authentication entirely once KRBTGT is compromised, making them extremely difficult to detect via logon monitoring alone; this hunt validates ticket-anomaly-based detection as one of the few reliable signals.
Step 2: Data Sources and Scope
- Sources: Domain Controller Security logs (4768 TGT request, 4769 TGS request, 4624 logon); Domain Kerberos policy baseline (GPO export).
- Scope: ~2022-06-04T09:30:00-10:00:00 UTC; Domain: corp.local; Suspicious account referenced:
svc_backup_old(disabled 8 months prior); Source workstation: WKS-IT-003. - SIEM Queries (Splunk/ELK):
- Anomalous ticket lifetime:
index=winsecurity EventID=4769 | eval lifetime=TicketLifetime | where lifetime > 36000 - Orphan TGS (no matching TGT):
index=winsecurity EventID=4769 | join TargetUserName, LogonId [search EventID=4768] | where isnull(4768_time) - Disabled-account ticket use:
index=winsecurity EventID=4769 TargetUserName="svc_backup_old"
Step 3: Key Findings
Parsed events (6 shown) confirm a forged TGT/TGS chain referencing a disabled account, granting access to the primary domain controller.
| Timestamp (UTC) | Host | Event | Details | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-06-04 09:31:02 | DC01 | 4769 TGS Request | TargetUserName=svc_backup_old; Ticket Encryption=0x17 (RC4); Service=cifs/DC01 | Encryption IOC: domain policy enforces AES-256 (0x12) for Kerberos; RC4 usage here is inconsistent with policy - classic Golden Ticket / Mimikatz golden module default. |
| 2022-06-04 09:31:02 | DC01 | (correlation check) | No corresponding 4768 for this LogonId in the prior 24 hours | Orphan-ticket IOC: a TGS was presented without a legitimate TGT ever having been issued by this KDC for this session - the hallmark of a forged ticket. |
| - | AD | (account status) | svc_backup_old - Enabled=False, disabled 2021-10-02 | Disabled-account IOC: the ticket references an account that has been disabled for 8 months - a forged ticket can reference any SID, including stale/disabled ones, since it isn't validated against live account state at initial forging. |
| 2022-06-04 09:31:05 | DC01 | 4624 Logon | Logon Type 3, Account=svc_backup_old, Source=WKS-IT-003 | Successful network logon to the domain controller using the forged ticket's identity. |
| 2022-06-04 09:32:40 | DC01 | 4769 TGS Request x6 | Multiple services requested (cifs, ldap, host) on DC01 and two file servers, all RC4, all same LogonId | Scope IOC: rapid multi-service ticket requests consistent with an attacker using a single forged TGT to request TGS tickets for several resources - pass-the-ticket-style lateral movement. |
| - | corp.local | (Kerberos policy GPO) | Max ticket lifetime configured = 10 hours | Forged ticket's embedded lifetime (per ticket analysis) exceeds the domain policy maximum - another concrete policy-violation indicator. |
Validation:
- Timeline: TGS request with no matching TGT → successful logon → rapid multi-service ticket requests - consistent with Golden Ticket forging followed by immediate lateral use.
- False Positives: GPO cross-check confirms no legitimate exception exists for RC4 or extended lifetimes; the disabled-account reference has no benign explanation.
- Correlation: All activity ties to a single LogonId originating from one workstation, referencing one (disabled) account - a tight, high-confidence indicator cluster.
Step 4: Recommendations & Next Steps
- Immediate Response: This indicates KRBTGT compromise - the only complete remediation is a double KRBTGT password reset (twice, with replication time between resets) domain-wide; isolate WKS-IT-003; hunt for the original credential-theft event that led to KRBTGT hash extraction (likely an earlier DCSync or NTDS.dit theft); assume full domain compromise until proven otherwise.
- Detection: Sigma-style rule:
title: Kerberos TGS Without Matching TGT (Orphan Ticket)→selection: EventID=4769 AND NOT [join LogonId: EventID=4768]combined withEncryptionType=RC4 AND domain_policy=AES-only- this pairing dramatically reduces false positives versus either signal alone. - Pro Tip: Golden Ticket detection is fundamentally about looking for absences (no matching 4768) and policy violations (wrong encryption type, wrong lifetime, disabled account) rather than looking for an obviously malicious event - train hunters to think in terms of "what should have happened first, and didn't."
Hypothesis confirmed - a forged Golden Ticket referencing a disabled service account was used to gain domain-controller access and pivot to multiple resources!