Pass-the-Ticket Lateral Movement

Overview

Pass-the-Ticket (PtT) lateral movement is a technique where adversaries use stolen Kerberos ticket-granting tickets (TGTs) or service tickets (TGSs) to authenticate to other systems within a network without needing to know user credentials. This method enables attackers to move laterally across an enterprise environment stealthily and efficiently, often bypassing traditional credential-based authentication controls.

Attack Objective

• Gain unauthorized access to additional systems and resources within a network
• Supports the Lateral Movement and Privilege Escalation stages of the attack lifecycle
• Advances the attacker’s position by enabling access to new hosts and services without re-authentication or credential exposure

How the Technique Works

Adversaries extract valid Kerberos tickets from compromised systems or memory and reuse these tickets to authenticate to other systems as the ticket owner. By injecting these tickets into the current session or authentication process, attackers can impersonate legitimate users or services, granting them access to resources across the network without triggering password authentication mechanisms.

Common Methods & Variations

• Extraction of tickets from memory using credential dumping tools
• Use of stolen TGTs for broad domain access or TGSs for specific service access
• On-premises environments leveraging Active Directory Kerberos implementations
• Cloud environments with federated Kerberos or hybrid identity solutions
• Living-off-the-land techniques using native OS utilities to inject or apply tickets
• Custom tooling designed to automate ticket extraction and injection

Indicators of Compromise (IOCs)

• Unusual Kerberos ticket requests or renewals outside normal user behavior
• Presence of forged or duplicated Kerberos tickets in memory or logs
• Authentication events showing ticket use from unexpected hosts or accounts
• Logs indicating ticket injection or use of non-standard authentication tools
• Endpoint alerts for credential dumping or memory scraping activities

Detection Strategies

• Monitoring Kerberos authentication logs and ticket-granting events for anomalies
• Behavioral analysis of ticket usage patterns and lateral authentication attempts
• Correlation of endpoint process execution with unusual ticket activity
• Use of identity and access management telemetry to detect abnormal ticket usage
• Employing heuristic detection to identify living-off-the-land tools and suspicious memory access

Mitigation & Prevention

• Implementing strong credential hygiene and limiting ticket lifetimes
• Enforcing least privilege and segmentation to reduce lateral movement opportunities
• Deploying multi-factor authentication to reduce reliance on ticket-based authentication alone
• Regularly monitoring and restricting access to high-value accounts and service tickets
• Applying security patches and hardening Kerberos implementations and domain controllers

Response Considerations

• Immediate isolation of affected hosts to prevent further lateral movement
• Comprehensive investigation of ticket usage and associated authentication events
• Credential resets and revocation of compromised tickets or accounts
• Review and enhancement of monitoring and detection capabilities post-incident
• Hardening of identity infrastructure and user access policies to prevent recurrence

Related Techniques

• Credential Dumping – often used to obtain tickets from memory
• Overpass-the-Hash – alternative Kerberos ticket abuse method
• Remote Service Session Hijacking – another lateral movement approach
• Golden Ticket – creation of forged Kerberos tickets for persistent access

Mapping & References

• MITRE ATT&CK Tactic: Lateral Movement (TA0008)
• MITRE ATT&CK Technique: Pass the Ticket (T1550.003)
• Public research and advisories from cybersecurity vendors and incident response reports detailing PtT activity