- Add validated mitre_attack frontmatter to all 754 skills (286 distinct
techniques), verified against MITRE ATT&CK v19.1 via the official
mitreattack-python library: 0 revoked, deprecated, or invalid IDs
- Curate precise per-skill technique IDs for forensics, malware-analysis,
threat-intel, and red-team skills (e.g. DCSync -> T1003.006,
Kerberoasting -> T1558.003, Pass-the-Ticket -> T1550.003)
- Reconcile v19.1 tactic restructuring: Defense Evasion split into
Stealth (TA0005) and Defense Impairment (TA0112); revoked T1562.*
family and T1070.001/.002 remapped to active equivalents (T1685.*)
- Normalize word-split tags across 35 skills (remove filename-derived
stopword tags, add semantic cybersecurity tags)
- Add api-reference.md for 3 skills that were missing it
- Update README ATT&CK section with accurate v19.1 tactic distribution
Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM
cybersecurity
threat-detection
kerberos
pass-the-ticket
active-directory
splunk
elastic
credential-theft
windows-security
1.0
mahipal
Apache-2.0
Token Binding
Execution Isolation
Restore Access
Application Protocol Command Analysis
Process Termination
DE.CM-01
DE.AE-02
DE.AE-06
ID.RA-05
T1078
T1190
T1059
T1003
T1110
Detecting Pass-the-Ticket Attacks
Overview
Pass-the-Ticket (PtT) is a credential theft technique (MITRE ATT&CK T1550.003) where adversaries steal Kerberos tickets (TGT or TGS) from one system and replay them on another to authenticate without knowing the user's password. This skill teaches detection of PtT attacks by correlating Windows Security Event IDs 4768 (TGT request), 4769 (TGS request), and 4771 (pre-authentication failure) for anomalies such as ticket reuse across different hosts, RC4 encryption downgrades, and unusual service ticket request volumes.
When to Use
When investigating security incidents that require detecting pass the ticket attacks
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Windows Domain Controller with advanced audit policy enabled (Audit Kerberos Authentication Service, Audit Kerberos Service Ticket Operations)
Splunk or Elastic SIEM ingesting Windows Security event logs
Sysmon deployed on endpoints for supplementary process telemetry
Python 3.8+ with requests library
Steps
Enable Kerberos audit logging on Domain Controllers via Group Policy
Forward Event IDs 4768, 4769, and 4771 to SIEM platform
Deploy detection rules for RC4 encryption downgrade (TicketEncryptionType 0x17)
Create correlation rule for ticket reuse across multiple source IPs
Build baseline of normal TGS request volume per user/host
Alert on standard deviation anomalies in ticket request patterns
Investigate flagged events with enrichment from Active Directory
Expected Output
JSON report containing detected PtT indicators including anomalous ticket requests, RC4 downgrades, cross-host ticket reuse events, and risk-scored users with MITRE ATT&CK technique mapping.
mukul975
cb8d79e068