skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-pass-the-ticket-attacks

Detect Kerberos Pass-the-Ticket attacks by correlating Windows Event IDs 4768, 4769, and 4771 in SIEM platforms.

954|172|Updated Mar 13, 2026
Search Tags:#threat detection#siem#splunk#credential theft#Active Directory#Kerberos#pass-the-ticket
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-pass-the-ticket-attacks
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-pass-the-ticket-attacks
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-detection/detecting-pass-the-ticket-attacks
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-pass-the-ticket-attacks

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests.

What problem does it solve?

Pass-the-Ticket attacks let adversaries replay stolen Kerberos tickets to authenticate without passwords, and naive detection rules miss AES-ticket replays and imports that generate no TGT request events. This Skill provides a structured detection methodology that catches cross-host ticket reuse, RC4 downgrades, and anomalous ticket request volumes.

Core Features & Use Cases

  • Multi-Event Correlation: Correlates Windows Security Event IDs 4768, 4769, and 4771 to identify ticket reuse from non-origin hosts and 4769 events with no matching 4768.
  • SIEM Detection Rules: Builds Splunk and Elastic queries for RC4 encryption downgrades (TicketEncryptionType 0x17) and per-user ticket request baselines with standard deviation alerting.
  • False Positive Tuning: Baselines per-user host counts and excludes jump hosts, VPN handoffs, and RODC referrals that generate benign multi-host patterns.
  • Use Case: A SOC analyst investigating lateral movement runs the correlation rule, finds a service ticket used from a second host with no intervening TGT request, and validates the alert fires using Atomic Red Team T1550.003.

Quick Start

Use this skill to build a Splunk correlation rule that detects Kerberos ticket reuse across multiple hosts from Event IDs 4768 and 4769.

Frequently Asked Questions about detecting-pass-the-ticket-attacks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect Pass-the-Ticket attacks in Splunk?▼

Detect Pass-the-Ticket by correlating Event IDs 4768, 4769, and 4771 in Splunk, alerting when a ticket appears from a host with no matching 4768 TGT request. Also alert on RC4 downgrade (TicketEncryptionType 0x17) and abnormal per-user TGS request volumes.

What Windows Event IDs indicate Pass-the-Ticket attacks?▼

Event IDs 4768 (TGT request), 4769 (TGS request), and 4771 (pre-authentication failure) are the core indicators. A 4769 from a host with no prior 4768 for that principal, or ticket reuse across different source IPs, signals replay.

Why do Pass-the-Ticket detection rules miss AES ticket attacks?▼

Rules hunting only for RC4 downgrades (0x17) miss PtT attacks using AES tickets (0x12) stolen from LSASS and replayed intact, since encryption looks normal. The stronger signal is ticket reuse from a non-origin host.

Can I use this detection with Elastic SIEM instead of Splunk?▼

Yes, the detection logic works in both Splunk and Elastic SIEM as long as Windows Security event logs from domain controllers are ingested. The same correlation of Event IDs 4768, 4769, and 4771 applies in either platform.

How do I validate that my Pass-the-Ticket detection rule fires?▼

Run Atomic Red Team test T1550.003 using Rubeus or mimikatz to dump tickets and inject them with ptt. Confirm the rule alerts when the same ticket is used from a second host and when a 4769 appears with no matching 4768.

What causes false positives in Kerberos ticket reuse detection?▼

Kerberos clock skew, ticket renewal, RODC referrals, and VPN or Wi-Fi handoffs create benign multi-host patterns. Baseline per-user host counts and exclude known jump hosts and admin bastions before alerting.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

detecting-kerberoasting-attacks

Detect Kerberoasting indicators from Windows Event 4769 and 4624 logs.

Community
Advanced
jaskaranhundaljaskaranhundal
3

threat-intelligence

Enrich security events by classifying IOCs and mapping behaviors to MITRE ATT&CK techniques.

Community
Advanced
balsm-healthbalsm-health
2

detecting-credential-dumping-techniques

Detect credential dumping techniques in Sysmon and Windows Security logs.

Official
Advanced
dreadnodedreadnode
11

credential-theft-hunt

Recover credentials and detect credential-theft tradecraft from Windows memory images with Volatility 3 and YARA.

Official
Advanced