Detecting Golden Ticket Forgery

This skill enables Claude to detect sophisticated Kerberos Golden Ticket attacks, a critical credential theft technique used for domain persistence. By auditing Windows Event ID 4769 for RC4 encryption downgrades, monitoring abnormal ticket lifetimes, and correlating TGS requests with missing TGT records, it helps security teams identify compromised krbtgt accounts. It provides structured guidance for Splunk and Elastic SIEM environments to automate the detection of Mimikatz-style attacks and ensure alignment with MITRE ATT&CK and NIST frameworks.

Key Features

Use Cases