# T1558 - Steal or Forge Kerberos Tickets

## SOC Recommendation
Investigate Steal or Forge Kerberos Tickets activity in the context of Credential Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| User Geolocation Logon Pattern Analysis | Detect | Monitor for User Geolocation Logon Pattern Analysis indicators relevant to this technique. |
| Credential Hardening | Harden | Apply Credential Hardening to reduce this technique's viability before an incident occurs. |
| Credential Revocation | Evict | Use Credential Revocation to remove the adversary's foothold once this technique is confirmed. |
| Network Traffic Filtering | Isolate | Apply Network Traffic Filtering to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Reset passwords for ALL targeted service accounts — use 30+ | Medium | No | Yes |
| Convert service accounts to Group Managed Service Accounts ( | Low | No | Yes |
| Remove unnecessary SPNs from high-privilege accounts | Low | No | Yes |
| Enforce AES-only Kerberos via GPO — disable RC4 | Medium | No | Yes |

## KQL
```kql
let lookback = 1d;
let ticketThreshold = 10;
SecurityEvent
| where TimeGenerated >= ago(lookback)
| where EventID == 4769
| where TicketEncryptionType == "0x17"
| where ServiceName !endswith "$"
| where AccountType == "User"
| summarize
    StartTime = min(TimeGenerated),
    EndTime = max(TimeGenerated),
    TicketRequestCount = count(),
    DistinctServices = dcount(ServiceName),
    Services = make_set(ServiceName, 50)
    by TargetUserName, IpAddress
| where TicketRequestCount >= ticketThreshold and DistinctServices >= 3
| project StartTime, EndTime, TargetUserName, IpAddress, TicketRequestCount, DistinctServices, Services
| extend timestamp = StartTime, AccountCustomEntity = TargetUserName, IPCustomEntity = IpAddress
| order by TicketRequestCount desc
```
```kql
afad_parser
| where MessageType == 2 and Codename == "Golden Ticket"
| extend HostName = tostring(split(Host, '.', 0)[0]), DnsDomain = tostring(strcat_array(array_slice(split(Host, '.'), 1, -1), '.'))
```
```kql
Pathlock_TDnR_CL
| where DataSource == "CHANGEDOC_KERBEROS"
| project TimeGenerated, Sysid, DataSource, Eventid, Instance, Hostname, Bname,
          Tcode, Report, Area, Subid, SrcIp, DestIp, AffectedUser, LogLine,
          MsgType, MsgId, MsgNo, MessageV1, MessageV2, MessageV3, MessageV4, CentralTs
```

## Escalation Criteria
- Steal or Forge Kerberos Tickets activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.