Wiki › Techniques, Tactics & Procedures (TTPs) › Privilege Escalation › Pass-the-Ticket for Privilege Escalation

Pass-the-Ticket for Privilege Escalation

2 min read

Jump to:

Overview

Pass-the-Ticket (PtT) is a credential theft technique used by adversaries to escalate privileges and move laterally within a network by leveraging Kerberos ticket-granting tickets (TGTs) or service tickets. It plays a critical role in the attack lifecycle by enabling attackers to impersonate users or services without needing to know their plaintext credentials, thereby facilitating stealthy access and persistence.

Attack Objective

Gain unauthorized access and control by impersonating legitimate users or services
Supports stages including Privilege Escalation, Lateral Movement, and Persistence
Advances attacker position by bypassing authentication mechanisms and expanding access within the environment

How the Technique Works

Adversaries extract Kerberos tickets from memory or disk on compromised systems and reuse them to authenticate to other systems or services. By injecting these stolen tickets into their session, attackers can impersonate the ticket owner’s identity, gaining access at the privilege level associated with the ticket without triggering password-based authentication alerts.

Common Methods & Variations

Extraction of tickets from memory using system tools or custom scripts
Use of stolen tickets on-premises in Active Directory environments or within cloud environments leveraging Kerberos-based authentication
Living-off-the-land techniques employing native OS utilities versus deployment of specialized tooling for ticket harvesting and injection

Indicators of Compromise (IOCs)

Unusual Kerberos ticket usage patterns such as ticket reuse across multiple hosts
Events indicating ticket extraction or injection, including suspicious calls to security APIs or credential dumping tools
Authentication logs showing anomalous service ticket requests or ticket lifetimes inconsistent with normal behavior

Detection Strategies

Telemetry from endpoint security solutions, authentication logs, and Kerberos service logs
Behavioral detection focusing on anomalies in ticket usage, such as multiple authentications with the same ticket or tickets used outside typical timeframes
Correlation of lateral movement indicators with ticket-related events to identify potential PtT activity

Mitigation & Prevention

Enforce strong credential hygiene and limit administrative privileges
Implement ticket lifetimes and renewal policies to reduce ticket reuse windows
Use multifactor authentication and restrict delegation settings in Active Directory

Response Considerations

Immediately isolate affected systems to prevent further ticket misuse
Investigate scope by analyzing ticket usage logs and identifying compromised accounts or systems
Reset credentials and revoke Kerberos tickets, followed by hardening authentication policies and monitoring for recurrence

Related Techniques

Credential Dumping – often precedes ticket theft by harvesting credentials or tickets
Lateral Movement – PtT facilitates movement across systems using stolen tickets
Golden Ticket – a variation involving forged Kerberos tickets for persistent, high-level access

Mapping & References

MITRE ATT&CK T1550.003: Use of Pass-the-Ticket for credential access and privilege escalation
Public research and advisories on Kerberos security and PtT detection methodologies
Incident reports detailing PtT usage in real-world intrusions

Tags: Active Directory credential theft Cybersecurity Incident Response Kerberos lateral movement MITRE ATT&CK Pass-the-Ticket privilege escalation Threat Detection