{"id":"T1558.002","name":"Silver Ticket","url":"https://attack.mitre.org/techniques/T1558/002","tactics":["credential-access"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0241","stix_id":"x-mitre-detection-strategy--77e72172-b088-4a98-bddd-ca04cbfc32ee","name":"Detect Forged Kerberos Silver Tickets (T1558.002)","url":"https://attack.mitre.org/detectionstrategies/DET0241","analytics":[{"id":"AN0675","stix_id":"x-mitre-analytic--88ece783-08bc-41e6-a000-a63f540768cc","name":"Analytic 0675","description":"Detects forged Kerberos Silver Tickets by identifying anomalous Kerberos service ticket activity such as malformed fields in logon events, TGS requests without interaction with the KDC, and access attempts using service accounts outside expected hosts/resources. Also monitors suspicious processes accessing LSASS memory for credential dumping.","url":"https://attack.mitre.org/detectionstrategies/DET0241#AN0675","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4672, 4634","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Kerberos","channel":"Kerberos TGS-REQ anomalies without KDC validation (Silver Ticket behavior)","data_component":"DC0084","data_component_name":"Active Directory Credential Request","log_source_slug":"wineventlog-kerberos"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ServiceAccountScope","description":"Expected mapping of service accounts to specific resources; deviations may indicate Silver Ticket use."},{"field":"TicketValidationBaseline","description":"Expected TGS issuance patterns including KDC validation; anomalies may signal forged tickets."},{"field":"ProcessAllowlist","description":"Known processes that legitimately interact with LSASS; others may indicate dumping attempts."},{"field":"TimeWindow","description":"Correlate Kerberos requests within a tunable timeframe to reduce false positives."}],"live":true,"detection_strategies":["DET0241"],"techniques":["T1558.002"]}],"live":true,"version":"1.0","techniques":["T1558.002"]}],"sigma_rules":[{"id":"b2e4a719-3c8f-4d1b-a507-f83c2d56e901","title":"DC Machine Account Network Logon from Non-DC Source IP","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"critical","date":"2026-07-29","modified":null,"description":"Detects a Domain Controller machine account authenticating from a source IP that is not\na known Domain Controller. DC machine accounts should only authenticate locally or from other DCs during\nreplication operations. Any logon event for a DC account from a workstation or non-DC host is anomalous and\nindicates one of the following:\n\n  - Silver Ticket: attacker forged a Kerberos TGS for a DC machine account without\n    requesting a TGT\n  - Pass-the-Ticket: attacker is replaying a captured DC machine account TGS from\n    a non-DC host\n  - Overpass-the-Hash: attacker converted a stolen DC machine account hash into a\n    Kerberos ticket and is authenticating from a non-DC host\n  - Exploitation of certain vulnerabilities such as CVE-2026-54121 (Certighost):\n    attacker obtained a DC certificate via ADCS CDC-chase\n    abuse, authenticates via PKINIT as the DC from their own host, then performs DCSync\n","references":["https://github.com/aniqfakhrul/CVE-2026-54121"],"logsource":{"product":"windows","service":"security"},"tags":["attack.credential-access","attack.lateral-movement","attack.t1550.003","attack.t1558.002","attack.t1649","cve.2026-54121"],"path":"rules-placeholder/windows/builtin/security/win_security_dc_machine_account_logon_non_dc_ip.yml","techniques":["T1550.003","T1558.002","T1649"],"cves":["CVE-2026-54121"]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}