Individual skill
detecting-golden-ticket-attacks-in-kerberos-logs
Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, looking for Kerberos TGT anomalies such as mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures. Use when hunting for Kerberos ticket forgery or krbtgt-based persistence (MITRE T1558.001) in AD environments.
skills/detecting-golden-ticket-attacks-in-kerberos-logs/SKILL.md
Source commit 54a798831d2266a3ca61ce68a7acb80b81160d57
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 35,876
- Repository last updated
- Aug 31, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai-agents Repository topic
- claude-code Repository topic
- cybersecurity Repository topic
- incident-response Repository topic
- mitre-attack Repository topic
- penetration-testing Repository topic
- red-team Repository topic
- security Repository topic
- cloud-security Repository topic
- malware-analysis Repository topic
- threat-hunting Declared skill tag
- golden-ticket Declared skill tag
- kerberos Declared skill tag
- active-directory Declared skill tag
- mitre-t1558-001 Declared skill tag
- credential-abuse Declared skill tag
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
LICENSEasset · 11,255 bytesSKILL.mdcore · 4,729 bytesreferences/api-reference.mddoc · 1,679 bytesscripts/agent.pyruns · 6,279 bytes
Read excerpt
# Detecting Golden Ticket Attacks in Kerberos Logs
## When to Use
- When KRBTGT account hash may have been compromised via DCSync or NTDS.dit extraction
- When hunting for forged Kerberos tickets used for persistent domain access
- After incident response reveals credential theft at the domain level
- When investigating impossible logon patterns (users logging in from multiple locations simultaneously)
- During post-breach assessment to determine if Golden Tickets are in use
## Prerequisites
- Windows Security Event IDs 4768, 4769, 4771 on domain controllers
- Kerberos policy configuration knowledge (max ticket lifetime, encryption types)