The Golden Ticket attack employs malicious actors to gain virtually unlimited access to company computers and Domain Controllers. This allows them to impersonate any domain user and carry out unauthorized actions on their behalf.
This attack can be difficult to detect and often goes undetected by automated security tools. However, human-led threat hunting can help identify these attacks more accurately.
What is a Golden Ticket Attack?
A Golden Ticket Attack is an attack against Windows that circumvents normal authentication processes and grants adversaries unrestricted access to all resources within an Active Directory domain. It takes advantage of flaws in the Kerberos authentication protocol, a standard widely used in global digital workplaces.
Golden Ticket attacks on AD domains typically involve hijacking KRBTGT, the Kerberos key distribution center (KDC) service account. Once compromised, this account can fabricate valid Ticket Granting Tickets (TGTs), or authentication tickets, that grant unauthorized access to resources within an organization's network.
This attack can be difficult to detect and remain undetected for years, so prevention begins with basic security hygiene and a multi-layered defense strategy. Regularly monitoring your network for golden ticket activity as well as purging any tickets that have been identified, are essential steps in mitigating its effects.
XDR can assist in detecting Golden Ticket attacks by monitoring for anomalies in Kerberos AS and TGS events that indicate pass-the-hash or Golden Ticket activity. These may include Windows logon and logoff events with empty fields, TGS ticket requests without prior TGT requests, or TGT tickets with arbitrary lifetime values.
Golden Ticket attack - History
The Golden Ticket Attack is a malicious cybersecurity exploit granting threat actors near unlimited access to an organization's domain (devices, files, and domain controllers) using user data stored in Microsoft Active Directory (AD). This attack takes advantage of a Kerberos identity authentication protocol vulnerability, allowing an adversary to bypass normal authentication methods and gain unrestricted control.
The origins of the Golden Ticket Attack can be traced back to a research paper published in 2011 by Benjamin Delpy. This paper presented proof of concept for an exploit using Mimikatz software, an ancient legacy code.
This tool was designed to harvest Windows credentials through various methods, such as user names, passwords, and hashes. This included employing advanced techniques like forging Kerberos tickets with the Kerberos Ticket Granting Ticket (TGT) and using a clever pass-the-hash technique.
Forging a TGT is the most complex and challenging aspect of a Golden Ticket Attack. This is because Kerberos is a stateless protocol, meaning the KDC cannot track who issued a TGT or which devices had previously received one valid one. Thus, attackers must use other means to obtain the most crucial information contained within a TGT: its password hash for the KRBTGT service account.
How does a Golden Ticket attack work?
A Golden Ticket attack uses vulnerabilities in the Kerberos identity authentication protocol to circumvent standard Active Directory (AD) authentication. By doing this, malicious actors can access devices, files, and domain controllers within an organization's domain.
Microsoft Kerberos authentication workflow involves the Key Distribution Center (KDC) working with domain controllers to generate tickets as proof of identity. These tickets are then sent to a Ticket Granting Service (TGS) so clients can access network services.
By exploiting KDC's service account (KRBTGT), attackers can create a "golden ticket" that appears authenticated to the KDC and can issue new tickets for any services. These tickets grant holders unlimited access to IT systems and data.
To launch a Golden Ticket attack, an attacker must steal the password hash for the KRBTGT account and use this information to create fake TGTs that appear authenticated to KDC. With this password, they can generate multiple forged TGTs that appear authenticated to the KDC and send them to any TGS to create tickets for any services the hacker desires.
To protect against Golden Ticket attacks, the best approach is to reduce the opportunities for attackers to obtain privileged credentials. For instance, don't let end-users log on to the company network with a privileged account, and keep them away from critical assets that could give an attacker access to launch a Golden Ticket attack.
How do attackers perform Golden Ticket attacks?
An Active Directory (AD) environment is the target of a Golden Ticket Attack, a cyberattack that targets access control privileges. Attackers can create fake Kerberos Ticket Granting Tickets and take over the Key Distribution Center (KDC) by accessing the KDC's keys.
These tickets provide domain users full access to any service on the domain, including servers, computers, and files. Attackers then utilize this access to spread malware and infect machines.
Attackers use a vulnerability in the Kerberos authentication protocol to generate a fraudulent ticket. Using their KDC account password hash, they can present this forged ticket for validation at a KDC.
This powerful and stealthy technique grants the attacker full access to everything in a domain. Unlike other attacks, this one can go undetected for days or years.
To thwart these attacks, AD teams must limit user and service accounts with privileged access to DCs to a minimum. Furthermore, they must continuously monitor Active Directory for any unusual behavior and guarantee that no unauthorized individuals gain entry to the domain.
Implement an extended detection and response (XDR) solution to detect Golden Ticket attacks effectively. XDR solutions collect threat data from multiple tools across the technology stack, enabling faster, more precise detection of these attacks.
How to Detect Golden Ticket Attacks?
Golden Ticket attacks grant attackers complete control over an organization's Active Directory (AD), including all computers, files, and folders. Furthermore, these attacks enable unauthorized users to execute malicious code on the network.
To detect a Golden Ticket attack, monitor AD for any unusual activity and install systems to prevent unauthorized users from accessing data. Doing this will minimize the effects of such an incident and guarantee you can address any problems before they become major.
A Golden Ticket (TGT) is an integral component of Kerberos authentication, used to protect and authenticate users in an organization's IT environment. Typically, authentication occurs through a key distribution center that verifies users' identities and assigns them a Kerberos Ticket Granting Ticket (TGT) that grants them access to certain network services.
How can XDR help detect Golden Ticket attacks?
A Golden Ticket attack is an insidious method hackers use to gain access to sensitive data and systems. These attacks are especially hazardous because they give the attacker full and unfettered control of an organization's Active Directory domain.
Organizations to detect a Golden Ticket attack must implement security tools that detect vulnerabilities, block access and reduce the chance of attackers gaining access to their network. This includes phishing email protection, IT hygiene measures, and privileged account management (PAM) tools.
Another way to protect against a Golden Ticket attack is to guarantee that only authorized personnel can access critical systems. This includes restricting the number of accounts and privileged credentials they possess.
XDR can also benefit organizations by giving them a comprehensive view of its network infrastructure. This insight gives security analysts more context, enabling them to formulate tailored threat responses that minimize harm or data leakage while maximizing efficiency and effectiveness.
XDR has become increasingly popular to provide security teams with a unified and prioritized view of cyber threats. It consolidates security tools and alerts, improving SOC response times and the productivity of IT and security personnel.
Tips to Prevent Golden Ticket Attacks
Organizations can take several steps to prevent Golden Ticket attacks. Traditional security best practices, such as using IT hygiene tools and training staff to recognize phishing emails, remain essential.
Another essential step to avoid Golden Ticket attacks is monitoring Active Directory regularly for changes in privileges and implementing an effective identity protection solution. By setting these systems in place, attackers will be prevented from gaining access to your network and the data you want.
It's essential to monitor event logging for suspicious activity, such as changes to TGT timestamps. A third-party Active Directory monitoring solution can provide alerts and report you need to stop a Golden Ticket attack in its tracks.
Furthermore, human-led threat hunting is essential to avoiding Golden Ticket attacks. These teams utilize the expertise of security professionals with years of experience in this area to detect malicious users.
XDR solutions integrate threat data from across an organization's technology stack to speed up threat hunting and identify Golden Ticket attacks faster. They also automate incident response with predefined workflows in their incident management console, allowing IT teams to detect and respond quickly to IoCs of Golden Ticket attacks, saving time and resources.