Which Windows Event IDs are used for detection?

This skill focuses on Windows Security Event IDs 4768 (Kerberos TGT requested) and 4769 (Kerberos Service Ticket requested).

Can this skill help with MITRE ATT&CK mapping?

Yes, it specifically targets technique T1558.001 (Golden Ticket) and provides structured output for risk scoring.

What is a Golden Ticket attack?

A Golden Ticket attack involves forging a Kerberos Ticket Granting Ticket (TGT) using the krbtgt account's NTLM hash, providing unrestricted access to an Active Directory domain.

Why is RC4 encryption (0x17) a red flag?

In modern environments enforcing AES, attackers often use RC4 for forged tickets because the NTLM hash can be used directly without the complexity of AES keys.

Does this skill work with Splunk and Elastic?

Yes, the skill is designed to provide logic and queries compatible with both Splunk and Elastic SIEM platforms.

Kerberos Golden Ticket Forgery Detection

Name: Kerberos Golden Ticket Forgery Detection
Author: micsapp

bymicsapp

0•

Seguridad y Pruebas

Detects Kerberos Golden Ticket forgery by identifying encryption downgrades and ticket anomalies within Windows Security Event logs.

This skill provides specialized cybersecurity intelligence for identifying Kerberos Golden Ticket attacks (MITRE ATT&CK T1558.001). It guides users through analyzing Windows Event ID 4769 to spot RC4 encryption downgrades (0x17) in environments where AES is enforced, identifying Service Ticket (TGS) requests that lack a corresponding TGT request, and flagging tickets with abnormal lifetimes. This is particularly useful for SOC analysts and threat hunters using Splunk or Elastic SIEM who need to detect credential theft and lateral movement within Active Directory environments.

Características Principales

01Identifies orphaned TGS requests without matching TGT logs

020 GitHub stars

03Maps findings to MITRE ATT&CK techniques for risk scoring

04Analyzes ticket lifetimes against MaxTicketAge domain policies

05Monitors krbtgt account password age and reset anomalies

06Detects RC4 (0x17) encryption downgrades in TGS requests

Casos de Uso

01Proactive threat hunting for persistent Kerberos-based threats

02Security incident investigation involving unauthorized domain access

03Validation of Active Directory security monitoring and logging coverage

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills detecting-golden-ticket-forgery

For use in Claude.ai and ChatGPT

Características Principales

01Identifies orphaned TGS requests without matching TGT logs

020 GitHub stars

03Maps findings to MITRE ATT&CK techniques for risk scoring

04Analyzes ticket lifetimes against MaxTicketAge domain policies

05Monitors krbtgt account password age and reset anomalies

06Detects RC4 (0x17) encryption downgrades in TGS requests

Casos de Uso

01Proactive threat hunting for persistent Kerberos-based threats

02Security incident investigation involving unauthorized domain access

03Validation of Active Directory security monitoring and logging coverage

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills detecting-golden-ticket-forgery

For use in Claude.ai and ChatGPT