Domain controllers become stepping stones for enterprise-wide compromise when attackers exploit Windows authentication weaknesses. Golden Ticket attacks forge domain-wide access using stolen KRBTGT credentials, persisting through password resets and system reboots. Silver Ticket attacks create service-specific access without touching domain controllers, making detection nearly impossible. Pass-the-Hash attacks turn any compromised endpoint into a launching pad for lateral movement across the network.
These attacks exploit flaws in Windows Active Directory authentication mechanisms that underpin domain security. Each creates different operational consequences: Golden Tickets grant persistent domain admin access, Silver Tickets provide targeted service access, and Pass-the-Hash enables immediate lateral movement using cached credentials.
Attack surfaces and threat vectors
Golden Ticket Attack Surface
KRBTGT account compromise creates indefinite domain persistence that survives most incident response efforts. Attackers extract KRBTGT credentials through DCSync operations after achieving domain admin privileges, then forge Ticket Granting Tickets with arbitrary user privileges and extended lifetimes. These forged tickets bypass authentication checks because they appear cryptographically valid to domain controllers.
The business consequence: attackers maintain domain admin access even after password resets, account lockouts, and system rebuilds. The attack surface spans every domain-joined system accepting Kerberos authentication. Most organizations never rotate KRBTGT passwords, creating persistence windows measured in years rather than days.
KRBTGT password rotation frequency determines the window of exposure. Regular rotation forces attackers to re-compromise domain admin access to maintain persistence. The operational challenge: KRBTGT rotation requires careful coordination across all domain controllers and can disrupt authentication during the transition period.
Silver Ticket attack surface
Service account credential theft enables targeted access that bypasses domain controller monitoring entirely. Attackers extract service account hashes from endpoints or obtain them through Kerberoasting attacks against service principal names. Each compromised service account enables forged tickets for specific services without KDC involvement.
Domain controllers cannot detect or revoke these tickets because they never process the authentication request. The scope is limited to services associated with the compromised account, but includes critical infrastructure like SQL servers, file shares, and web applications. Detection difficulty increases because tickets appear valid to target services.
The tradeoff is limited scope versus reduced detection probability. Organizations with extensive service account privileges face broader exposure when individual accounts become compromised.
Pass-the-Hash attack surface
NTLM authentication design flaws turn cached credentials into permanent access tokens. The attack accepts password hashes directly without requiring plaintext passwords, exploiting any system that caches NTLM credentials through interactive logons or saved credentials.
Attackers extract NTLM hashes from compromised endpoints using credential dumping tools, then authenticate to file shares, administrative interfaces, and legacy applications across network segments. The attack works without active domain controller communication, making it difficult to correlate with authentication logs.
Credential caching policies determine exposure duration. Systems with long-lived cached credentials or service accounts with interactive logon rights expand the attack surface. NTLM restriction policies and Credential Guard implementation limit the effectiveness of extracted hashes.
Detection guidance
Golden Ticket detection
Monitor for TGT requests with unusual characteristics indicating forged tickets. Golden tickets often contain extended lifetimes, non-standard encryption types, or user accounts that should not request TGTs.
SIEM detection query - unusual TGT lifetime:
event_id:4768 AND ticket_lifetime:>10080 AND ticket_lifetime:≠1440
| where ticket_lifetime > 604800000
| stats count by account_name, client_address, ticket_lifetime
SIEM detection query - KRBTGT authentication events:
(event_id:4624 OR event_id:4625) AND account_name:"krbtgt"
| where account_name contains "krbtgt" AND logon_type != 3
| stats count by source_address, account_name, auth_package
Monitor for Kerberos authentication failures followed immediately by successful authentication from the same source. This pattern indicates potential ticket manipulation attempts.
Log sources required: Domain controller security logs, Kerberos authentication logs, and network authentication monitoring. Enable advanced audit policy for Kerberos service ticket operations.
Silver Ticket detection
Detect service authentication that bypasses normal KDC ticket-granting processes. Silver tickets create authentication events without corresponding TGT requests in domain controller logs.
SIEM detection query - service authentication without TGT:
event_id:4624 AND logon_type:3 AND auth_package:"Kerberos"
| join type=left (event_id:4768) on account_name within 5m
| where isnull(tgt_request)
| stats count by service_name, account_name, source_address
SIEM detection query - suspicious SPN access:
event_id:4769 AND (service_name:"CIFS/*" OR service_name:"HTTP/*" OR service_name:"MSSQL/*")
| where failure_code = "0x0" AND ticket_encryption != "0x12"
| stats count by account_name, service_name, client_address
Monitor for service account authentication events occurring outside normal service windows or from unexpected source addresses. Silver ticket attacks generate authentication patterns inconsistent with legitimate service behavior.
Pass-the-Hash detection
Identify NTLM authentication events indicating hash reuse rather than interactive password entry. Pass-the-hash attacks create specific authentication patterns in Windows security logs.
SIEM detection query - NTLM authentication anomalies:
event_id:4624 AND logon_type:3 AND auth_package:"NTLM" AND logon_process:"NtLmSsp"
| where account_name != "ANONYMOUS LOGON" AND account_name != "*$"
| stats dc(source_address) as unique_sources by account_name
| where unique_sources > 5
SIEM detection query - privileged account NTLM usage:
event_id:4624 AND auth_package:"NTLM" AND (
account_name:*admin* OR account_name:*service* OR
group_membership:*"Domain Admins"* OR group_membership:*"Enterprise Admins"*
)
| stats count by account_name, source_address, dest_host
Monitor for NTLM authentication to Kerberos-capable systems, which may indicate attackers avoiding Kerberos due to missing credentials. Legitimate systems prefer Kerberos when available.
Mitigation strategies
Golden Ticket mitigations
KRBTGT password rotation invalidates existing Golden Tickets but requires operational coordination across domain controllers. Microsoft recommends rotating KRBTGT passwords twice with waiting periods between rotations to ensure all domain controllers receive updates. The tradeoff is operational complexity versus persistent access prevention.
KRBTGT rotation schedule:
- Immediate rotation after suspected compromise
- Quarterly rotation for high-security environments
- Annual rotation for standard environments
Enable Protected Users group membership for privileged accounts to prevent NTLM authentication and credential caching. This group forces Kerberos-only authentication and reduces credential exposure on endpoints. The limitation is compatibility with legacy applications requiring NTLM.
Deploy Kerberos Armoring (FAST) to encrypt authentication requests and prevent credential interception. Armoring protects against offline attacks on intercepted authentication traffic. Implementation requires Windows Server 2012 or later domain functional level.
Silver Ticket mitigations
Service account privilege auditing limits Silver Ticket impact scope when accounts become compromised. Review SPN assignments regularly and remove unnecessary service registrations. The principle is reducing blast radius through minimal privilege assignment.
Implement service account password rotation using Group Managed Service Accounts (gMSA) where application compatibility allows. gMSA accounts automatically rotate passwords and eliminate manual credential management. The tradeoff is application compatibility requirements versus automated security controls.
Configure service ticket lifetime policies to reduce Silver Ticket validity windows. Shorter ticket lifetimes force more frequent re-authentication, increasing detection opportunities. Balance security requirements with application performance needs.
Pass-the-Hash mitigations
Deploy Windows Defender Credential Guard on endpoints to isolate credentials in virtualized environments. Credential Guard prevents credential dumping techniques by protecting LSASS memory. Implementation requires UEFI firmware and virtualization capabilities on target systems.
Implement NTLM restriction policies to force Kerberos authentication where legacy application support allows. Configure domain controllers to reject NTLM authentication for domain accounts except when explicitly required. Test thoroughly before deployment to avoid breaking legacy applications.
NTLM restriction implementation:
1. Enable NTLM auditing to identify usage patterns
2. Configure NTLM blocking for outgoing connections
3. Implement domain controller NTLM restrictions
4. Block NTLM for domain accounts on member servers
Remove local administrator rights from standard user accounts to prevent credential dumping access. Use Local Administrator Password Solution (LAPS) to manage unique local administrator passwords on each endpoint. The operational impact is increased help desk calls versus reduced lateral movement risk.
Configure Windows Firewall to restrict administrative tool access to approved management systems. This prevents attackers from using dumped credentials for remote administration. Implement jump boxes or privileged access workstations for administrative tasks.
Detection rules
# Golden Ticket Detection Rule
name: "Suspicious Kerberos TGT Lifetime"
query: |
event_id:4768
| where ticket_lifetime > 43200 OR renewal_lifetime > 604800
| stats count by account_name, client_address, ticket_lifetime
severity: high
false_positive_rate: low
# Silver Ticket Detection Rule
name: "Service Authentication Without TGT"
query: |
event_id:4624 AND logon_type:3 AND auth_package:"Kerberos"
| join type=left (event_id:4768) on account_name within 300s
| where isnull(tgt_request) AND account_name != "*$"
severity: medium
false_positive_rate: medium
# Pass-the-Hash Detection Rule
name: "NTLM Authentication to Kerberos Systems"
query: |
event_id:4624 AND auth_package:"NTLM" AND logon_type:3
| where dest_supports_kerberos = true
| stats count by account_name, source_address
severity: medium
false_positive_rate: medium
Kerberos hardening checklist
Immediate actions:
- [ ] Audit current KRBTGT password age and plan rotation
- [ ] Inventory privileged accounts for Protected Users group eligibility
- [ ] Review service account SPN assignments and privileges
- [ ] Enable Kerberos authentication auditing on domain controllers
Short-term implementation:
- [ ] Deploy NTLM usage auditing to identify restriction candidates
- [ ] Configure Credential Guard on critical endpoints
- [ ] Implement LAPS for local administrator password management
- [ ] Review and restrict administrative tool network access
Long-term strategy:
- [ ] Migrate service accounts to Group Managed Service Accounts
- [ ] Implement Kerberos Armoring domain-wide
- [ ] Deploy comprehensive NTLM restriction policies
- [ ] Establish regular KRBTGT rotation procedures
