Steal or Forge Kerberos Tickets

What it means

Kerberos ticket theft or forgery abuses ticket-based authentication material to access services. The underlying credential or signing exposure influences what must be recovered.

MITRE ATT&CK catalogs this behavior as T1558, within credential access. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.

An investigation example

An incident involving privileged identity material is followed by unusual service-ticket use across several hosts.

Evidence to examine

Review ticket-related events, identity scope, originating hosts, service access, and relevant key exposure.

A common analytical pitfall

A valid-looking ticket can be used by an unauthorized actor; not all unusual ticket patterns prove forgery.

Response considerations

Protect affected identities and key material under a validated recovery plan and investigate resource access using the exposed trust relationship.

Tickets are credentials within a trust system

A fictional enterprise uses Kerberos for service authentication. A ticket can let a holder access a service under the protocol's rules without supplying the user's password to that service. Theft or forgery therefore concerns credential authority, not simply disclosure of a readable password.

Different ticket types and account keys play different roles. The consequence of one compromised service credential is not automatically identical to compromise of a central trust key. Investigators should identify the material involved, the accepted service context, and relevant lifetime before describing the scope. Avoid using a broad technique label as a substitute for that analysis.

Authentication evidence can be complex and distributed. Compare expected issuance, service use, account privileges, and endpoint activity. Missing issuance records may reflect a logging gap rather than forgery, while anomalous service access can have several causes. Correlate multiple sources and preserve uncertainty.

Draw the legitimate authentication relationship

For a classroom exercise, use fictional accounts to draw a user, the ticket-granting infrastructure, and an application service. Label which component issues a credential and which component accepts it. Then describe a stolen-ticket scenario separately from an unauthorized-ticket-creation scenario. No live ticket collection or forgery is needed.

Containment depends on the affected trust material. It may require ticket or session invalidation, credential changes, and carefully coordinated key recovery under platform guidance. An ordinary user password reset is not a universal answer to every Kerberos compromise. A good report explains the observed acceptance path, affected identities and services, evidence strength, and recovery dependencies. This helps responders restore the relevant trust boundary without overstating or understating the incident.

Related concepts

• Authentication
• Least privilege
• Incident response
• Use Alternate Authentication Material