Techniques › T1558 › T1558.002
T1558.002 Silver Ticket
credential access — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
1
Sigma rules tagged attack.t1558.002
0
KEV CVEs mapped here
<p>Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.</p><p>Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.</p><p>Password hashes for target services may be obtained using OS Credential Dumping or Kerberoasting.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0241 Detect Forged Kerberos Silver Tickets (T1558.002) v1.0
AN0675 WindowsDetects forged Kerberos Silver Tickets by identifying anomalous Kerberos service ticket activity such as malformed fields in logon events, TGS requests without interaction with the KDC, and access attempts using service accounts outside expected hosts/resources. Also monitors suspicious processes accessing LSASS memory for credential dumping.WinEventLog:Kerberos
Kerberos TGS-REQ anomalies without KDC validation (Silver Ticket behavior)→ DC0084 Active Directory Credential RequestTunable:ServiceAccountScopeTicketValidationBaselineProcessAllowlistTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1558.002
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-29 · logsource: product=windows service=security · b2e4a719-3c8f-4d1b-a507-f83c2d56e901
Detects a Domain Controller machine account authenticating from a source IP that is not
a known Domain Controller. DC machine accounts should only authenticate locally or from other DCs during
replication operations. Any logon event for a DC account from a workstation or non-DC host is anomalous and
indicates one of the following:
- Silver Ticket: attacker forged a Kerberos TGS for a DC machine account without
requesting a TGT
- Pass-the-Ticket: attacker is replaying a captured DC machine account TGS from
a non-DC host
- Overpass-the-Hash: attacker converted a stolen DC machine account hash into a
Kerberos ticket and is authenticating from a non-DC host
- Exploitation of certain vulnerabilities such as CVE-2026-54121 (Certighost):
attacker obtained a DC certificate via ADCS CDC-chase
abuse, authenticates via PKINIT as the DC from their own host, then performs DCSync
Rules tagged at the parent level (attack.t1558) 6
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: frack113
· 2022-10-14 · logsource: product=windows service=security · 5a44727c-3b85-4713-8c44-4401d5499629
Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 78cc2dd2-7d20-4d32-93ff-057084c38b93
Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
Author: frack113
· 2022-10-14 (modified 2023-12-14) · logsource: product=windows service=security · 94309181-d345-4cbf-b5fe-061769bdf9cb
Detects logon with "Special groups" and "Special Privileges" can be thought of as Administrator groups or privileges.
Author: Florian Roth (Nextron Systems), David ANDRE
· 2021-11-08 (modified 2024-06-27) · logsource: product=windows category=file_event · 9e099d99-44c2-42b6-a6d8-54c3545cab29
Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.
Author: frack113
· 2025-03-05 · logsource: product=windows category=ps_script · cdfa73b6-3c9d-4bb8-97f8-ddbd8921f5c5
Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.
Author: Ilyas Ochkov, oscd.community
· 2019-10-24 (modified 2024-03-15) · logsource: product=windows category=network_connection · e54979bd-c5f9-4d6c-967b-a04b19ac4c74
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.