What Is a Golden Ticket Attack?

Updated on August 4, 2025

A Golden Ticket attack represents one of the most devastating post-exploitation techniques in cybersecurity. This sophisticated attack method allows threat actors to forge Kerberos Ticket Granting Tickets (TGTs) using stolen cryptographic material from the domain’s KRBTGT account.

The attack grants attackers unrestricted, persistent access to any resource within a compromised Active Directory (AD) domain. By impersonating any user — including domain administrators — attackers effectively bypass normal authentication mechanisms and maintain control for extended periods.

Understanding Golden Ticket attacks is critical for cybersecurity professionals and AD administrators. These attacks represent a worst-case scenario where threat actors achieve total domain compromise through Kerberos protocol abuse.

Definition and Core Concepts

A Golden Ticket attack is a cyberattack where threat actors forge a Kerberos TGT using the stolen NTLM hash or AES key of the domain’s KRBTGT account. This forged TGT allows attackers to impersonate any user, including domain administrators, and gain unrestricted, persistent access to any resource within the compromised AD domain.

The attack bypasses normal authentication mechanisms entirely. Attackers don’t need actual user passwords or legitimate credentials once they possess the KRBTGT account’s cryptographic material.

Understanding the Core Components

• Kerberos Authentication Protocol serves as the foundation for Windows authentication in AD environments. The protocol uses tickets to verify user identities and grant access to network resources. TGTs act as initial authentication tokens, while service tickets provide access to specific resources.
• Active Directory functions as Microsoft’s directory service that manages users, computers, and resources across enterprise networks. AD relies heavily on Kerberos for secure authentication and authorization processes.
• Key Distribution Center (KDC) operates as the Kerberos service running on Domain Controllers. The KDC issues and signs all authentication tickets for the domain, making it central to the security architecture.
• KRBTGT Account represents the special, built-in Kerberos Service Account in AD. This account acts as the KDC’s master key, encrypting and signing all TGTs for the entire domain. Compromising this account effectively breaks the entire domain’s security model.
• Ticket Granting Tickets (TGTs) are initial authentication tickets issued by the KDC. These tickets prove a user’s identity and allow them to request service tickets for specific resources without re-entering credentials.

The attack relies on several key capabilities. Impersonation allows attackers to act as any user within the domain. Persistence enables maintaining long-term access even after initial entry points are discovered and closed. Lateral Movement facilitates spreading through the network to access additional resources and systems.

Common tools used for these attacks include Mimikatz, Impacket, and Rubeus. These open-source tools provide the technical capabilities needed to extract cryptographic material and forge tickets.

How It Works

Golden Ticket attacks follow a precise technical execution flow that requires significant initial compromise before achieving persistent domain control.

Initial Compromise and Privilege Escalation

Attackers must first achieve Domain Administrator privileges or compromise a Domain Controller directly. Golden Ticket attacks are post-exploitation techniques, not initial access methods.

Common initial compromise methods include phishing campaigns that lead to endpoint compromise, followed by privilege escalation techniques. Attackers might also exploit vulnerable services to gain local administrator access on a Domain Controller.

The critical requirement is obtaining high-level privileges within the AD environment. Without this initial foothold, attackers cannot access the cryptographic material needed for ticket forgery.

Obtaining Domain Information

Once attackers establish high-level access, they gather critical domain details including the Fully Qualified Domain Name (FQDN) and Domain Security Identifier (SID). This information is essential for crafting convincing forged tickets that will be accepted by domain systems.

Attackers typically enumerate the AD environment to understand the domain structure, identify high-value targets, and map privilege relationships between accounts and resources.

Stealing the KRBTGT Account Hash

The most critical phase involves extracting the KRBTGT account’s NTLM hash or AES encryption key from a compromised Domain Controller. This cryptographic material serves as the “master key” for signing Kerberos tickets.

Attackers commonly target the Local Security Authority (LSA) process or the AD database (NTDS.dit) on Domain Controllers. Tools like Mimikatz use commands such as lsadump::dcsync /user:DOMAIN\KRBTGT or lsadump::lsa /inject /name:krbtgt to extract this sensitive information.

Impacket’s secretsdump.py provides another method for obtaining these critical hashes from compromised systems.

Forging Kerberos Tickets

With the KRBTGT hash in hand, attackers use specialized tools to craft forged TGTs. Mimikatz’s kerberos::golden function, along with Impacket and Rubeus, provides the technical capability for ticket creation.

Attackers specify several parameters during ticket creation. They can impersonate any username, including non-existent accounts, though recent Windows updates from November 2021 require real user accounts for successful authentication.

Group memberships can be arbitrarily assigned by specifying Relative IDs (RIDs) for privileged groups like Domain Admins. This allows attackers to grant themselves maximum privileges within the domain.

Ticket lifetimes can be extended far beyond the default 10 hours, often set for years to ensure long-term persistence.

Injecting and Using Golden Tickets

The forged TGT is injected into the attacker’s current session memory, effectively replacing legitimate authentication tokens. Once injected, attackers can request Ticket Granting Service (TGS) tickets for any service or resource within the domain.

This process bypasses normal authentication requirements entirely. Attackers don’t need to provide passwords or other credentials — the forged TGT serves as proof of their claimed identity and privileges.

Achieving Persistent Access and Lateral Movement

Golden Tickets enable near-unlimited access across the entire domain infrastructure. Attackers can access any system or service, create or modify user accounts, and exfiltrate sensitive data without raising traditional security alerts.

The persistence aspect is particularly concerning. Forged tickets can maintain access for months or years, often surviving initial breach detection and standard remediation efforts like user password resets.

Golden Ticket attacks exhibit several distinctive characteristics that make them particularly dangerous and challenging to detect.

• Post-Exploitation Technique: These attacks require initial high-level compromise, specifically Domain Admin access or DC compromise. They represent advanced persistent threat activity rather than initial breach methods.
• Kerberos Protocol Abuse: The attacks exploit inherent trust relationships within the Kerberos authentication system. By forging legitimate-looking tickets, attackers abuse the protocol’s design rather than exploiting traditional vulnerabilities.
• KRBTGT Hash Dependency: The entire attack hinges on compromising the KRBTGT account’s cryptographic material. This hash serves as the master key for all domain authentication processes.
• Unrestricted Domain Access: Successful attacks grant comprehensive access to all domain resources. Attackers can access any system, service, or data repository within the compromised environment.
• Extended Persistence: Forged tickets can have artificially extended lifespans, providing long-term access that survives many standard security measures and incident response actions.
• Detection Evasion: Forged tickets appear valid to standard authentication systems, making them difficult to detect through conventional security monitoring approaches.
• Password Independence: Attackers don’t need actual user passwords once they possess forged tickets, making traditional password-based security measures ineffective.

The MITRE ATT&CK framework categorizes these attacks under T1558.001 (Steal or Forge Kerberos Tickets), spanning both Persistence and Credential Access tactics.

Implications

Golden Ticket attacks enable several high-impact scenarios that demonstrate their severe threat potential.

• Total Domain Compromise represents the most significant implication. Attackers gain complete control over the AD environment, including all user accounts, computer systems, and data repositories.
• Espionage and Data Exfiltration becomes trivial once attackers establish Golden Ticket access. Long-term, undetected access enables systematic theft of intellectual property, customer data, and sensitive business information.
• Infrastructure Sabotage is possible through unrestricted system access. Attackers can disrupt critical business operations, modify or destroy data, and compromise essential services.
• Detection Evasion allows attackers to blend into legitimate network activities. Forged tickets appear valid to most security systems, enabling attackers to operate without triggering traditional alerts.
• Supply Chain Attacks can leverage Golden Ticket persistence to pivot from initially compromised organizations to their business partners, customers, or vendors through trusted network connections.
• Remediation Resistance makes Golden Ticket attacks particularly persistent. Standard incident response measures like user password resets don’t invalidate forged tickets, allowing attackers to maintain access even after initial breach discovery.

Countermeasures and Mitigation

Defending against Golden Ticket attacks requires comprehensive security measures that address both prevention and detection capabilities.

Protecting the KRBTGT Account

• Regular Password Rotation represents the most critical defense mechanism. Microsoft recommends resetting the KRBTGT account password twice in succession at least annually, or immediately after any suspected domain compromise.
  • Two password resets are necessary because Domain Controllers maintain both current and previous password hashes. A single reset doesn’t invalidate existing Golden Tickets that use the previous hash.
• KRBTGT Account Monitoring should include alerts for any unusual access, modification attempts, or unauthorized password changes. This account should rarely require legitimate administrative attention.
• Strict Access Controls must protect Domain Controllers and the LSASS process where KRBTGT hashes reside. Limiting access reduces opportunities for hash extraction.

Implementing Strong Privileged Access Management

• Least Privilege Principles dramatically reduce the number of users with Domain Admin or equivalent high-level privileges. Fewer privileged accounts mean fewer potential targets for initial compromise.
• Just-in-Time (JIT) Access eliminates standing Domain Admin privileges by granting elevated access only when needed and for limited durations. This approach reduces the window of opportunity for attackers.
• Privileged Session Management includes comprehensive monitoring and recording of all administrative activity on Domain Controllers. This enables rapid detection of suspicious actions that could lead to KRBTGT compromise.

Enhanced Kerberos Monitoring and Logging

• Centralized Log Management aggregates AD Domain Controller security event logs into Security Information and Event Management (SIEM) systems for comprehensive analysis.

Anomalous TGT Activity Detection focuses on several key indicators:

• Unusually long TGT lifetimes that exceed default values (typically 10 hours)
• TGS requests without corresponding TGT requests, indicating potential ticket injection
• RC4 encryption cipher usage when AES encryption is the organizational standard
• Tickets issued for non-existent usernames or with invalid Security Identifiers
• Privileged accounts accessing unusual resources or from unexpected network locations

Critical Event IDs for monitoring include:

• Event ID 4768: Kerberos Authentication Ticket (TGT) was Requested
• Event ID 4769: Kerberos Service Ticket was Requested 
• Event ID 4770: Kerberos Service Ticket was Renewed
• Event ID 4624: Successful Account Logon

Implementing Windows Defender Credential Guard

• Credential Protection isolates LSA secrets using virtualization-based security, making direct credential dumping significantly more difficult. This technology creates substantial barriers for tools like Mimikatz attempting to extract KRBTGT hashes.
• Hardware Requirements include modern processors with specific virtualization capabilities, but the security benefits justify the investment for high-value Domain Controllers.

Domain Controller Hardening

• Regular Patching ensures Domain Controllers receive all Microsoft security updates promptly, especially Kerberos-related patches like the November 2021 security updates that affect username validation in forged tickets.
• Endpoint Detection and Response (EDR) deployment on Domain Controllers provides advanced threat detection capabilities specifically designed to identify credential dumping attempts and other malicious activities.
• Physical and Network Access Restrictions limit who can access Domain Controllers directly, reducing opportunities for local attacks that could compromise KRBTGT material.
• DCSync Activity Monitoring alerts on replication requests from non-Domain Controller accounts, as this technique is commonly used for hash extraction.

Implementing Kerberos Armoring

• Flexible Authentication Secure Tunneling (FAST) provides additional cryptographic protection for Kerberos exchanges by encrypting portions of the authentication process. This makes ticket manipulation and downgrade attacks more difficult.

Incident Response Planning

• Specialized Playbooks should address suspected Golden Ticket attacks with specific procedures for immediate KRBTGT password resets and comprehensive domain analysis.
• Forest Rebuild Considerations may be necessary in severe cases where Golden Ticket attacks have persisted undetected for extended periods. Complete AD forest reconstruction ensures total eradication of attacker presence.

Key Terms Appendix

• Golden Ticket Attack: A cyberattack that forges Kerberos TGTs to gain unrestricted, persistent domain access through KRBTGT account compromise.
• Kerberos Authentication Protocol: Network authentication protocol using tickets for secure identity verification in Windows AD environments.
• Active Directory (AD): Microsoft’s directory service managing users, computers, and resources across enterprise networks.
• Key Distribution Center (KDC): Kerberos service running on Domain Controllers responsible for issuing and signing authentication tickets.
• KRBTGT Account: Special AD account serving as the KDC’s master key, encrypting and signing all TGTs for the domain.
• Ticket Granting Ticket (TGT): Initial Kerberos authentication ticket proving user identity and enabling service ticket requests.
• NTLM Hash/AES Key: Cryptographic representations of passwords; the targeted secrets in Golden Ticket attacks.
• Persistence: Maintaining long-term unauthorized access to compromised systems and networks.
• Lateral Movement: Spreading through a network after gaining initial access to expand compromise scope.
• Privilege Escalation: Gaining higher-level access permissions within compromised systems or networks.
• Mimikatz: Open-source tool commonly used for credential dumping and executing Kerberos-based attacks.
• Domain Controller (DC): Server running AD services and managing domain authentication and authorization.
• Local Security Authority (LSA): Windows process storing sensitive security data including authentication credentials.
• Security Identifier (SID): Unique identifier assigned to users, groups, and domains within Windows environments.
• DCSync: Mimikatz technique that mimics Domain Controller replication to extract password hashes.
• Relative ID (RID): Component of SIDs that uniquely identifies users or groups within specific domains.
• RC4 Cipher: Stream cipher with known cryptographic weaknesses, sometimes exploited in forged tickets.
• Privileged Access Management (PAM): Security approach controlling and monitoring privileged account access and activities.
• Just-in-Time (JIT) Access: Security model providing temporary, time-limited privilege grants rather than permanent elevated access.