MITRE ATT&CKtechnique

T1558 Steal or Forge Kerberos Tickets

Published 2020-02-11 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Credential Access
Platforms
Linux, macOS, Windows
Version
1.7
Created
2020-02-11

Description

Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC). Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access. On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.

Related

Tactic · MITRE ATT&CK (1)

  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (6)

  • M1041 Encrypt Sensitive Information mitigation
  • M1043 Credential Access Protection mitigation
  • M1047 Audit mitigation
  • M1015 Active Directory Configuration mitigation
  • M1026 Privileged Account Management mitigation
  • M1027 Password Policies mitigation

Referenced by MITRE ATT&CK · subtechnique of (5)

Referenced by MITRE ATT&CK · uses (2)

  • C0063 2025 Poland Wiper Attacks campaign
  • G1024 Akira group

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-652 Use of Known Kerberos Credentials attack pattern

Referenced by Compliance · mitigates (19)

  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-18 Wireless Access NIST 800-53 control
  • NIST-AC-19 Access Control for Mobile Devices NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SC-4 Information in Shared System Resources NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References