T1558Credential Access
Steal or Forge Kerberos Tickets
Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC). Clients request access to a service and…
CVEs4
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.4
Reports1
Detections
6 Sigma rules tagged T1558Steal or Forge Kerberos TicketsT15586 general rules
- Antivirus - Password Dumper Signaturecriticalstable
- HackTool - Mimikatz Kirbi File Creationcriticaltest
- Replay Attack Detectedhightest
- Uncommon Outbound Kerberos Connectionmediumtest
- Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlockmediumexperimental
- User with Privileges Logonlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Steal or Forge Kerberos Tickets
4 CVEs, by priority. Each link shows its badge.- CVE-2014-6324Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation VulnerabilityMicrosoft · Kerberos Key Distribution Center (KDC)KEVPublic exploitHigh · 8.8T1078Valid AccountsT1558Steal or Forge Kerberos Tickets1 reportAI mapping from the description · primary impact87.3%Top 0.25%73.0priority
- CVE-2024-13159Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityIvanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 moreMITRE CTID mapping of the KEV entry · how it is exploited>99.9%Top 0.01%68.2priority
- CVE-2024-13160Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityIvanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 moreMITRE CTID mapping of the KEV entry · how it is exploited91.0%Top 0.19%68.2priority
- CVE-2024-13161Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityIvanti · Endpoint Manager (EPM)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1558Steal or Forge Kerberos Tickets+2 moreMITRE CTID mapping of the KEV entry · how it is exploited89.8%Top 0.21%68.2priority