T1550.003Lateral Movement
Pass the Ticket
Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system. When preforming PtT…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
7 Sigma rules tagged T1550.003Pass the TicketT1550.0037 general rules
- HackTool - Rubeus Executioncriticalstable
- DC Machine Account Network Logon from Non-DC Source IPcriticalexperimental
- HackTool - KrbRelayUp Executionhightest
- HackTool - Rubeus Execution - ScriptBlockhightest
- DC Machine Account TGS Request from Non-DC Source IPhighexperimental
- DC Machine Account TGT Request from Non-DC Source IPhighexperimental
- Uncommon Outbound Kerberos Connectionmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Pass the Ticket
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.