Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Credential Access/ T1558

T1558Steal or Forge Kerberos Tickets

T1558 — Steal or Forge Kerberos Tickets is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 6 detection use cases covering it and 4 threat-intel articles citing it.

Credential Access
View on the matrix → Filter Detection Library MITRE official spec ↗
6Use cases
4Articles
5Sub-techniques
1Tactic

Sub-techniques (5)

T1558.004 · AS-REP RoastingT1558.005 · Ccache FilesT1558.001 · Golden TicketT1558.003 · KerberoastingT1558.002 · Silver Ticket

Use cases covering this technique (6)

Windows Computer Account Created by Computer Account ESCU actions · alerting P Windows Computer Account Requesting Kerberos Ticket ESCU actions · alerting P Windows Computer Account With SPN ESCU actions · alerting P Windows Domain Admin Impersonation Indicator ESCU actions · alerting P Windows Kerberos Local Successful Logon ESCU actions · alerting P Windows Steal or Forge Kerberos Tickets Klist ESCU actions · hunting P

Articles citing this technique (4)

crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller art-97
high GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration art-153
crit DynoWiper update: Technical analysis and attribution art-684
crit CISA KEV: CVE-2014-6324 — Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability art-2437