Golden and Silver Ticket Attacks

Forged Kerberos tickets built from stolen long-term keys. The core insight: the KDC and every service validate tickets by decrypting them with a secret key — and those keys are just the NT hashes (or AES keys) of the krbtgt account and of service accounts respectively. Whoever holds the key can mint a ticket the KDC or service will trust, with arbitrary contents, without a valid password ever being involved.¹ MITRE T1558.001 (Golden) / T1558.002 (Silver), Credential Access.²³

Silver ticket (T1558.002)

A forged service ticket (TGS) for one specific service/SPN, encrypted with the service account’s stolen key.⁴

• Requires: NT hash / AES key of the target service account (machine account for HOST-based SPNs, or a user service account).
• Bypasses the KDC entirely — the forged ticket is presented straight to the service (AP-REQ). No TGS-REQ, so no Event 4769 on the DC; the only logging is on the target service itself (if any).⁵
• Scope: one service on one box — but PAC contents are attacker-chosen, so the ticket can claim any user and any group memberships as that service sees them.

# Mimikatz — forge a CIFS ticket for a file server
kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID \
    /target:files01.$DOMAIN /service:cifs /rc4:$MACHINE_ACCOUNT_NT_HASH \
    /ptt

Golden ticket (T1558.001)

A forged TGT, encrypted/signed with the krbtgt account’s stolen key.⁶

• Requires: the krbtgt NT hash (or AES key) — obtainable only via privileged access to a domain controller (DCSync over drsuapi, NTDS.dit extraction, LSASS on a DC).⁷
• Power: present the forged TGT to the KDC and receive legitimate TGS tickets for any service, as any user — including accounts that don’t exist. Effectively unrestricted domain access, and the standard persistence mechanism after domain compromise: even if every user password is reset, the forged TGT still works until krbtgt is rotated.⁸
• Noisier than silver: the attacker does talk to the KDC (TGS-REQ), so most normal Kerberos logging (4768/4769) fires — the anomaly is in the PAC (impossible groups, nonexistent users, lifetime > policy).

# Mimikatz
kerberos::golden /user:Administrator /domain:$DOMAIN /sid:$DOMAIN_SID \
    /krbtgt:$KRBTGT_NT_HASH /ptt
 
# Rubeus
Rubeus.exe golden /rc4:$KRBTGT_NT_HASH /user:Administrator /ptt

Comparison

	Silver	Golden
Forged artifact	Service ticket (TGS)	TGT
Key needed	Service account key	krbtgt key
Talks to KDC?	No	Yes
Logging	Target service only	DC 4768/4769 + service
Scope	One service/SPN	Whole domain
Best for	Quiet, targeted access	Persistence, total control

Detection & defenses

• Rotate krbtgt twice after any suspected domain compromise — the definitive containment for golden tickets. Microsoft’s Reset the krbtgt account password/keys guidance covers this; two rotations are required because the previous key remains valid for the old-password window.⁹
• PAC validation: services can verify the PAC with the KDC (KERB_VERIFY_PAC_REQUEST); enable it where supported — forged silver tickets with fabricated PACs fail.¹⁰
• Anomalies to alert on: tickets with lifetimes exceeding policy, nonexistent users, krbtgt use from unexpected sources, TGS requests whose TGT has no matching 4768, and golden-ticket signature detections in Defender for Identity.¹¹
• Limit service-account privileges; machine-account silver tickets (CIFS/HOST) are the most common because computer hashes leak via DCSync too.
• Tiered administration (the same hygiene as against pass-the-ticket) reduces the odds of krbtgt or service keys being harvested in the first place.

Related: kerberos, kerberoasting, as-rep-roasting, rubeus, ntlm-relay-attacks, passkeys (the Silver/Golden Pass-ta-key naming heir — SDS ≈ krbtgt).

Sources

• MITRE ATT&CK T1558.001 — Golden Ticket
• MITRE ATT&CK T1558.002 — Silver Ticket
• hackndo — Kerberos Silver & Golden Tickets
• adsecurity.org — Kerberos Golden Tickets are Now More Golden (Sean Metcalf, 2015)
• Microsoft Learn — AD Forest Recovery: Reset the krbtgt password
• Quest — Golden Ticket Attacks: How They Work and How to Defend Against Them
• Microsoft Learn — Reset the krbtgt account password (original URL) — dead link (moved to AD Forest Recovery guide, archived above)

Footnotes

1. hackndo — Kerberos Silver & Golden Tickets ↩

2. MITRE ATT&CK T1558.001 — Golden Ticket ↩

3. MITRE ATT&CK T1558.002 — Silver Ticket ↩

4. MITRE ATT&CK T1558.002 — Silver Ticket ↩

5. hackndo — Kerberos Silver & Golden Tickets ↩

6. MITRE ATT&CK T1558.001 — Golden Ticket ↩

7. Quest — Golden Ticket Attacks: How They Work and How to Defend Against Them ↩

8. adsecurity.org — Kerberos Golden Tickets are Now More Golden (Sean Metcalf, 2015) ↩

9. Microsoft Learn — AD Forest Recovery: Reset the krbtgt password ↩

10. hackndo — Kerberos Silver & Golden Tickets ↩

11. Quest — Golden Ticket Attacks: How They Work and How to Defend Against Them ↩