A golden ticket opens the whole domain. A silver ticket opens one door, but it does so quietly. Silver Ticket (T1558.002) is a Windows Credential Access technique, a subtechnique of Steal or Forge Kerberos Tickets.
How attackers use it
MITRE describes adversaries who hold the password hash of a target service account, such as SharePoint or MSSQL, forging Kerberos ticket granting service (TGS) tickets. These are also called service tickets.
Silver tickets are narrower than golden tickets. They only grant access to a particular resource and the system that hosts it. The trade-off for the adversary is stealth: unlike golden tickets, they can create these tickets without interacting with the Key Distribution Center, which potentially makes detection harder.
MITRE says service password hashes may be obtained using OS Credential Dumping or Kerberoasting.
How to detect it
MITRE's analytic looks for anomalous service ticket activity: malformed fields in logon events, service ticket use with no interaction with the KDC, and access attempts using service accounts outside their expected hosts or resources. It also watches for suspicious processes accessing LSASS memory for credential dumping.
Since the domain controller never sees the forged ticket, the evidence lives on the target server. Log logons on servers that run important services, and look for service account activity that has no matching ticket request on the domain controllers.
How to reduce the risk
MITRE lists three mitigations.
- Password policies. Give service accounts long passwords, ideally 25 characters or more, with complexity and periodic expiry. Consider Group Managed Service Accounts or a password vault.
- Privileged account management. Limit service accounts to the privileges they need, and keep them out of privileged groups such as Domain Administrators.
- Encrypt sensitive information. Enable AES Kerberos encryption rather than RC4 where possible.
Quick check
Why can a silver ticket be harder to detect than a golden ticket?
It can be created without contacting the Key Distribution Center, so the domain controller has no record of the request.
