Pass the Ticket (T1097)

View on ATT&CK

In Playbook

Technique & Subtechniques

  • Pass the Ticket

Associated Tactics

  • Lateral Movement

Lateral Movement (TA0008)

The adversary is trying to move through your environment. Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target and subsequently gaining access to it. Reaching their objective often involves pivoting through multiple systems and accounts to gain. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier.

View on ATT&CK

Procedure Examples

Description Source(s)
capec
Metcalf, S. (2014, November 22). Mimikatz and Active Directory Kerberos Attacks. Retrieved June 2, 2016. ADSecurity AD Kerberos Attacks
Deply, B. (2014, January 13). Pass the ticket. Retrieved June 2, 2016. GentilKiwi Pass the Ticket
Campbell, C. (2014). The Secret Life of Krbtgt. Retrieved December 4, 2014. Campbell 2014
Abolins, D., Boldea, C., Socha, K., Soria-Machado, M. (2016, April 26). Kerberos Golden Ticket Protection. Retrieved July 13, 2017. CERT-EU Golden Ticket Protection