detecting-golden-ticket-attacks-in-kerberos-logs

Correlate Windows Security Events 4768 and 4769 on domain controllers: a service ticket request (4769) with no preceding TGT request (4768) from the same account and IP indicates a forged ticket. Also flag RC4 encryption (0x17) in AES-only environments and ticket lifetimes exceeding policy.

The Skill provides Splunk SPL and KQL queries. The Splunk query filters EventCode 4769 with TicketEncryptionType 0x17 excluding krbtgt, while the KQL query summarizes 4769 events by user, IP, and service to surface RC4 anomalies and missing prior TGT requests.

Yes. Diamond tickets modify a real TGT, so a matching 4768 event exists and the '4769 without prior 4768' heuristic fails. They also use realistic 10-hour AES lifetimes, defeating the classic RC4 and impossible-lifetime rules. Hunt identity anomalies like non-existent accounts and injected SIDs instead.

RC4 encryption is legitimate in legacy trusts and older applications, so the RC4 anomaly rule fires on normal traffic. Scope the rule to domains confirmed as AES-only and allowlist known legacy SPNs to reduce noise.

Events 4768, 4769, and 4771 must be forwarded from every domain controller. Missing even one DC's logs breaks the TGS-without-prior-TGT correlation, making legitimate tickets look forged and forged tickets look legitimate.

Reset the KRBTGT account password twice, because both the current and previous hashes remain valid until the second reset. Also verify PAC validation enforcement via KB5008380/KB5037754 and the PacRequestorEnforcement registry state so forged PACs are rejected.