Can this skill be used with Splunk or Elastic SIEM?

Yes, this skill provides procedures for analyzing Windows security event logs ingested into popular SIEM platforms like Splunk and Elastic.

What is a Golden Ticket attack?

A Golden Ticket attack is a credential theft technique where an adversary forges a Kerberos Ticket Granting Ticket (TGT) using the krbtgt account's NTLM hash to gain unrestricted access to any service in an Active Directory domain.

How does the skill detect encryption downgrades?

It flags TGS requests that use RC4 encryption (0x17) in environments where AES is the established baseline, a common indicator of Mimikatz-style ticket forgery.

Which Windows Event IDs are monitored by this skill?

This skill primarily focuses on analyzing Windows Security Event IDs 4768 (TGT Request) and 4769 (Service Ticket Request) to identify anomalies indicative of forgery.

Does this skill require specific domain policies?

Effective detection requires a known Kerberos encryption policy baseline (such as AES enforcement) and Kerberos audit logging enabled on Domain Controllers.

Detecting Golden Ticket Forgery

Name: Detecting Golden Ticket Forgery
Author: mukul975

bymukul975

•

4,121

•

安全与测试

Identifies unauthorized Kerberos Ticket Granting Ticket (TGT) forgery by analyzing Windows Event IDs and encryption anomalies in SIEM platforms.

This skill enables Claude to detect sophisticated Kerberos Golden Ticket attacks, a critical credential theft technique used for domain persistence. By auditing Windows Event ID 4769 for RC4 encryption downgrades, monitoring abnormal ticket lifetimes, and correlating TGS requests with missing TGT records, it helps security teams identify compromised krbtgt accounts. It provides structured guidance for Splunk and Elastic SIEM environments to automate the detection of Mimikatz-style attacks and ensure alignment with MITRE ATT&CK and NIST frameworks.

主要功能

01Maps findings directly to MITRE ATT&CK and NIST CSF frameworks

02Analyzes Windows Event ID 4769 for RC4 (0x17) encryption downgrades

03Identifies orphan TGS requests missing corresponding TGT events

044,121 GitHub stars

05Monitors krbtgt account password age and reset anomalies

06Detects abnormal Kerberos ticket lifetimes exceeding domain policies

使用场景

01Building automated detection rules for Splunk or Elastic SIEM

02Threat hunting for Active Directory persistence during security incidents

03Validating security monitoring coverage against credential theft techniques

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills detecting-golden-ticket-forgery

For use in Claude.ai and ChatGPT

主要功能

01Maps findings directly to MITRE ATT&CK and NIST CSF frameworks

02Analyzes Windows Event ID 4769 for RC4 (0x17) encryption downgrades

03Identifies orphan TGS requests missing corresponding TGT events

044,121 GitHub stars

05Monitors krbtgt account password age and reset anomalies

06Detects abnormal Kerberos ticket lifetimes exceeding domain policies

使用场景

01Building automated detection rules for Splunk or Elastic SIEM

02Threat hunting for Active Directory persistence during security incidents

03Validating security monitoring coverage against credential theft techniques

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills detecting-golden-ticket-forgery

For use in Claude.ai and ChatGPT