Pass-the-Ticket Attack Prevention Checklist for Secure Environments

Understanding the Kerberos Mechanism

Kerberos is a network authentication protocol that uses tickets to verify identity. When a user logs in, the system issues a Ticket Granting Ticket. This ticket allows the user to request access to specific services without re-authenticating. Attackers steal these tickets to impersonate users. The stolen ticket acts as a valid key. The system trusts the ticket, not the person holding it. This mechanism enables lateral movement.

An attacker moves from one machine to another. They do not need the user's password. They only need the cached ticket. This bypasses password complexity requirements. It also bypasses account lockout policies. The attack is silent. Standard login logs may not show suspicious activity. The system sees a valid ticket. It grants access as normal. You must assume tickets are valuable assets. Protecting them requires specific configurations.

Ticket Lifetime and Renewal Controls

• Reduce default ticket lifetime: Shorter windows limit the time an attacker has to use a stolen ticket.
• Disable ticket renewal: Preventing renewal forces re-authentication, which can trigger alerts if the attacker lacks credentials.
• Enforce strict logoff policies: Automatic logoff destroys cached tickets, removing the asset from the system.
• Configure service ticket limits: Limiting the lifespan of specific service tickets reduces exposure for high-value targets.
• Audit Kerberos policies: Regular reviews ensure that lifetime settings have not drifted from security baselines.
• Implement smart card logon: Smart cards store credentials in hardware, making ticket theft significantly harder.

Account and Privilege Management

• Disable built-in administrator accounts: Default admin accounts are high-value targets for ticket theft and lateral movement.
• Enforce least privilege access: Users should only have access to the resources they strictly need for their role.
• Remove local admin rights: Standard users should not have administrative privileges on workstations or servers.
• Implement just-in-time access: Grant administrative rights only when needed, then revoke them immediately after use.
• Audit service accounts: Service accounts often have long-running sessions and high privileges, making them ideal targets.
• Disable unused accounts: Dormant accounts are often overlooked and can be used to steal tickets undetected.

Monitoring and Detection Strategies

• Monitor for multiple service requests: A single user accessing many services rapidly indicates potential ticket abuse.
• Detect unusual ticket encryption types: Older encryption types may indicate an attacker using stolen legacy tickets.
• Alert on logon type 10: Network logons combined with high-privilege access can signal a pass-the-ticket attempt.
• Track ticket granting ticket usage: Unusual TGT usage patterns can reveal the initial compromise point.
• Integrate with network traffic analysis: Correlating authentication events with network flows helps identify lateral movement paths.
• Use Sysmon for process tracking: Monitoring processes that access credential caches can reveal theft attempts.

Response and Containment Procedures

• Reset affected user passwords: Changing passwords invalidates existing tickets, stopping the attack chain.
• Revoke active sessions: Forcefully logging out users destroys cached tickets on their machines.
• Isolate compromised hosts: Disconnecting affected machines prevents further lateral movement within the network.
• Review recent authentication logs: Identify all systems accessed by the stolen ticket to determine the scope.
• Update incident triage plans: Ensure your response team knows how to handle credential theft scenarios.
• Conduct post-incident review: Analyze the attack vector to improve defenses and prevent recurrence.

See also: Tactical Threat Intelligence: Practical Indicators for Small Business Defense · Snort and Suricata Rules Checklist for Network Defense

Integrating with Broader Security

Pass-the-ticket attacks often follow initial access. Attackers may use spear phishing or exploit vulnerabilities. Once inside, they look for cached tickets. You must integrate this checklist with your broader security strategy. Consider how incident triage procedures handle credential theft. Your response must be swift. Delay allows attackers to move deeper.

Look at network traffic analysis capabilities. Can you see lateral movement? Can you detect anomalous traffic? These tools complement authentication monitoring. You also need to consider honeypots. Can you place decoy accounts to detect ticket theft? This adds another layer of detection. Your defenses must be layered. No single control is sufficient. You must combine prevention, detection, and response.

Final Configuration Checks

• Verify Kerberos encryption standards: Ensure all systems support strong encryption algorithms.
• Check for constrained delegation: Limit which services can act on behalf of users.
• Audit group policy objects: Ensure security policies are applied consistently across all systems.
• Review domain controller logs: Centralized logging is critical for detecting cross-system attacks.
• Test detection rules regularly: Simulate attacks to ensure your monitoring tools catch the activity.
• Update security awareness training: Teach staff about the risks of leaving sessions unattended.

Key takeaways

• Kerberos tickets allow access without re-entering passwords, making them prime targets for theft.
• Default ticket lifetimes are often too long, giving attackers ample time to exploit stolen credentials.
• Monitoring for unusual service ticket patterns is the only reliable way to detect active abuse.

Frequently asked questions

How do I know if a pass-the-ticket attack is happening?

Look for a single user account accessing multiple services rapidly or using encryption types not typically seen in your environment.

Does changing a password stop a pass-the-ticket attack?

Yes, resetting the password invalidates the associated Kerberos tickets, forcing the attacker to re-authenticate with credentials they likely do not have.

Are pass-the-ticket attacks only relevant for large enterprises?

No, any organization using Active Directory or Kerberos-based authentication is vulnerable. Small businesses with domain controllers are prime targets.

Can firewalls prevent pass-the-ticket attacks?

No, firewalls control network traffic but cannot inspect the content of authentication tickets. You need internal monitoring and strict ticket policies.

How this guide was produced: written by the CloudSec Pulse editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.