MITRE ATT&CKsub-technique

T1550.003 Pass the Ticket

Published 2020-01-30 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Lateral Movement
Platforms
Windows
Version
2.0
Created
2020-01-30

Description

Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system. When preforming PtT, valid Kerberos tickets for Valid Accounts are captured by OS Credential Dumping. A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access. A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access. A Silver Ticket can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (e.g., SharePoint). A Golden Ticket can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory. Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys. For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user (i.e. Pass the Hash) while also using the password hash to create a valid Kerberos ticket.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1550 Use Alternate Authentication Material technique

Tactic · MITRE ATT&CK (1)

  • TA0008 Lateral Movement tactic

Referenced by MITRE ATT&CK · mitigates (4)

  • M1015 Active Directory Configuration mitigation
  • M1018 User Account Management mitigation
  • M1026 Privileged Account Management mitigation
  • M1027 Password Policies mitigation

Referenced by MITRE ATT&CK · uses (6)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-645 Use of Captured Tickets (Pass The Ticket) attack pattern

Referenced by Compliance · mitigates (12)

  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References