Home/ MITRE Matrix/ Lateral Movement/ T1550.003

T1550.003Pass the Ticket

T1550.003 — Pass the Ticket is a MITRE ATT&CK technique in the Lateral Movement tactic. Clankerusecase tracks 5 detection use cases covering it and 1 threat-intel article citing it.

Lateral Movement

View on the matrix → Filter Detection Library MITRE official spec ↗

5Use cases

1Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1550 · Use Alternate Authentication Material

Use cases covering this technique (5)

Mimikatz PassTheTicket CommandLine Parameters ESCU actions · alerting P Rubeus Command Line Parameters ESCU actions · alerting P Rubeus Kerberos Ticket Exports Through Winlogon Access ESCU actions · alerting P Windows Process With NetExec Command Line Parameters ESCU actions · alerting P [LLM] Domain Controller machine account obtains TGT via PKINIT certificate (Certighost impersonation) Bespoke exploit · hunting SΣP

Articles citing this technique (1)

crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller art-97