detecting-golden-ticket-forgery

Detect Golden Ticket attacks by analyzing Event ID 4769 for RC4 encryption (0x17) in AES-enforced domains, TGS requests without matching 4768 TGT requests, and ticket lifetimes exceeding MaxTicketAge policy. Correlate these indicators in Splunk or Elastic SIEM.

Event ID 4769 (TGS request) is the primary indicator, especially with RC4 encryption type 0x17 or missing a corresponding 4768 TGT request. Post-KB5008380, also watch Kerberos Event 4 and KDC PAC validation failure errors.

No. Diamond and Sapphire tickets request a genuine TGT and re-encrypt with AES (0x12), so RC4-based rules and orphaned-4769 logic both miss them. Detection requires PAC validation failures and krbtgt password-age anomaly monitoring instead.

Yes. The procedure works with either Splunk or Elastic SIEM as long as Windows Security event logs from Domain Controllers are forwarded and ingested. Python 3.8+ supports offline event log analysis as an alternative.

Long-lived service tickets from scheduled tasks and clustered services legitimately exceed normal lifetimes, triggering benign alerts. Baseline lifetimes per service and reset krbtgt twice so historical legitimate tickets are not flagged during rotation windows.