Golden Tickets, Silver Tickets and Pass-the-Hash are different credential-abuse techniques, not interchangeable names. A Golden Ticket forges a Kerberos ticket-granting ticket (TGT) with the domain’s KRBTGT secret and can support broad domain impersonation. A Silver Ticket forges a Kerberos service ticket (TGS) with a target service account’s secret and is limited to that service and host. Pass-the-Hash (PtH) reuses password-hash material, usually over an NTLM-capable authentication path, without requiring the cleartext password.
The distinction determines where defenders can see evidence. Golden Ticket investigations emphasize domain-controller Kerberos events and abnormal ticket characteristics; Silver Ticket investigations must include the destination service host because ticket creation can occur without contacting the Key Distribution Center (KDC); PtH investigations correlate successful logons, NTLM context, endpoint activity and source-account behavior.
As an Amazon Associate I earn from qualifying purchases.
What the three techniques have in common—and why the difference matters
All three techniques let an intruder authenticate as another identity, but they abuse different authentication artifacts. Kerberos uses tickets. The KDC, a domain service that issues and validates Kerberos tickets, normally provides a TGT after initial authentication and then issues TGS tickets for particular services. The KRBTGT account is the Active Directory account whose secret protects the domain’s ticket-granting process.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutePass-the-Hash does not reuse a Kerberos ticket. It reuses password-hash material as authentication material, commonly through NTLM-capable paths. It is therefore possible to see legitimate NTLM traffic that is unrelated to PtH. A suspicious NTLM event is an investigation lead, not proof by itself.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Method | Artifact abused | Typical scope | Must the KDC see it? | Most important visibility |
|---|---|---|---|---|
| Golden Ticket (MITRE ATT&CK T1558.001) | Forged Kerberos TGT made with KRBTGT-derived secret material | Potentially broad domain identity impersonation | Not necessarily for the forged TGT’s use | Domain-controller Kerberos events, ticket characteristics, privileged logons and endpoint activity |
| Silver Ticket (T1558.002) | Forged Kerberos service ticket made with a target service account’s secret | A particular service, resource and hosting system | No; creation can occur without KDC interaction | Destination service-host authentication and resource-access logs, plus endpoint and DC context |
| Pass-the-Hash (T1550.002) | Reused password-hash material | Accounts and systems reachable through applicable authentication paths | Depends on the authentication path; commonly uses NTLM-capable paths | Successful logons, NTLM package and source context, process telemetry and expected account-to-host patterns |
Pass-the-Ticket is a separate technique: it reuses existing Kerberos ticket material. Do not label a ticket-reuse incident as Pass-the-Hash merely because both involve stolen credentials.
Golden Ticket: forged domain-level Kerberos identity
What is forged
A Golden Ticket is a counterfeit TGT. The attacker’s objective is to make the domain accept a ticket that claims a chosen identity and authorization data. Because the TGT is the basis for requesting service tickets, compromise can have domain-wide implications rather than being confined to one server.
The risk is not that every forged ticket automatically grants unlimited access. Access still depends on the identity and authorization data presented, the services reached and controls in the environment. However, compromise of the KRBTGT secret is serious enough to require a domain recovery process, not merely deletion of one endpoint artifact.
Recommended Free Tools
Detection signals
MITRE’s Golden Ticket detection guidance points to combinations of anomalies rather than one magic event:
- Ticket lifetimes that are inconsistent with domain policy or the normal lifetime of issued tickets.
- Unexpected encryption types, such as RC4 in an environment where RC4 is not expected. RC4 is not automatically malicious; the question is whether its use conflicts with the domain’s configuration and baseline.
- TGS activity that lacks a preceding, normal-looking TGT-request pattern.
- Malformed or unusual fields in logon and logoff records.
- Unexpected privileged logons or elevated access, especially when the account, host, time or source does not fit established behavior.
- Endpoint evidence showing unusual process access to security-sensitive authentication material or activity associated with ticket manipulation.
Windows Security event 4769 can help examine service-ticket requests. Events such as 4672 and 4634 provide logon-session and privilege context. Sysmon process-access telemetry can add endpoint evidence when it is deployed and configured. These events are analytic inputs, not standalone proof. A long ticket, RC4, a missing request event or an elevated logon can each have benign explanations.
How to investigate a suspected Golden Ticket
- Establish the baseline. Document normal ticket lifetimes, encryption types, domain-controller behavior, privileged-account use and expected administrative hosts. Without this baseline, “unusual” is only an assumption.
- Correlate the identity and host. Compare the ticket’s account, source system, destination service, time and privilege level with the user’s normal pattern. Look for access from systems that do not ordinarily administer the affected resource.
- Review domain-controller evidence. Examine Kerberos request and service-ticket activity, including event 4769, and look for service use without the expected preceding authentication sequence.
- Add endpoint context. Check process creation, process-access telemetry and security-tool findings on the originating host. A ticket anomaly paired with suspicious endpoint activity is stronger than either signal alone.
- Scope the identity impact. Identify privileged accounts and systems touched during the ticket’s possible lifetime. Treat the incident as an Active Directory compromise until evidence narrows it.
Containment and recovery
When the KRBTGT secret may be compromised, MITRE recommends resetting the built-in KRBTGT account password twice. Two coordinated resets are required because one reset does not invalidate every currently usable ticket. Plan the operation as an Active Directory recovery change: verify replication, account for ticket lifetimes, coordinate domain controllers and validate that legitimate authentication continues after each reset.
Silver Ticket: a service-specific forged Kerberos ticket
What is forged
A Silver Ticket is a forged TGS for a particular service. It is created with the password hash of the account that the service uses, such as an account supporting a server service. The result is narrower than a Golden Ticket: the counterfeit ticket is aimed at a specific resource and the host that provides it.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
That narrower scope does not make Silver Tickets harmless. A service account may have substantial rights on its server, file shares, databases or applications. The practical blast radius depends on that account’s permissions and on what the host can reach.
Why domain-controller logs can miss it
MITRE states that adversaries able to forge Silver Tickets can create TGS tickets without interacting with the KDC, potentially making detection more difficult. Because the KDC may never see the creation or use sequence, a domain-controller-only monitoring strategy can lack the decisive evidence. The destination service host is an essential log source.
Detection signals
- Service authentication from an account, client host or time window that does not match the service’s normal operating pattern.
- Resource access by a service identity outside its expected servers, applications or administrative workflows.
- Malformed logon data or unusual service-ticket characteristics when those fields are available to the service and endpoint telemetry.
- Authentication to a host without a corresponding, normal KDC request trail.
- Endpoint activity on the client that suggests credential or ticket manipulation.
None of these signals proves forgery by itself. Service accounts often have unusual schedules and machine-to-machine behavior, so baselines must include scheduled jobs, clustered services, failover hosts and maintenance windows.
How to investigate a suspected Silver Ticket
- Start at the destination. Identify the exact service, host, account and resource involved. Preserve service-side authentication and access logs before retention windows remove them.
- Baseline the service identity. List the hosts, applications, protocols, source systems and schedules that legitimately use the account. Flag use outside that map.
- Compare KDC and host evidence. Determine whether normal ticket-request activity exists for the observed service use. Absence is a clue, not conclusive proof, because logging gaps and protocol variations can also explain it.
- Trace the client endpoint. Review process, network and credential-access telemetry on the source host. Look for a sequence linking the endpoint to the service access.
- Assess account permissions. Enumerate what the service account can access and rotate or disable it according to the organization’s service-account change procedure if compromise is credible.
Pass-the-Hash: reusing password-hash authentication material
What is reused
PtH lets an attacker authenticate with a password hash without knowing the cleartext password. It is commonly associated with NTLM-capable authentication, although the exact path depends on the Windows versions, services and policy controls in use. The technique can affect any account and system reachable through that path, so its scope is defined by credential reuse and network access rather than by a forged Kerberos ticket.
What event 4624 can tell you
Microsoft describes Security event 4624 as a successful logon record. Its fields can help investigators evaluate:
- The account that authenticated and the logon type.
- The source network address and destination computer.
- The authentication package, including whether NTLM was used.
- Process and session context associated with the logon.
Collect the event on the accessed computer, then correlate it with endpoint and network evidence. Compare the source address, account, time and destination with organizational expectations. A privileged account authenticating from an unusual workstation, or an account suddenly reaching many unrelated hosts, deserves review; neither pattern alone establishes PtH.
NTLM auditing and reduction
Microsoft’s NTLM auditing policy records NTLM traffic in the Microsoft-Windows-NTLM operational log. Auditing is a discovery step: it shows dependencies so administrators can identify legacy applications, devices and workflows before changing enforcement. The audit policy itself records traffic and does not mitigate PtH.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
After dependencies are understood, evaluate restriction or blocking controls appropriate to the deployed Windows versions. Policy names and supported controls vary across versions, so validate them against the organization’s current fleet. Pair protocol reduction with credential hygiene, privileged-account separation, endpoint protections and rapid response to suspicious logons.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Detection differences at a glance
| Detection question | Golden Ticket | Silver Ticket | Pass-the-Hash |
|---|---|---|---|
| What should analysts verify first? | Ticket lifetime, encryption, request sequence, identity and privilege context | Service host, service account, resource and expected KDC trail | Successful logon fields, NTLM package, source address, process and account-to-host pattern |
| Where is visibility weakest? | When forged-ticket use lacks a normal TGT request and endpoint evidence is absent | On domain controllers, because ticket creation can bypass the KDC | When NTLM is common and legitimate, making protocol use non-unique |
| Best correlation partners | DC Kerberos events, privileged logons and endpoint process-access telemetry | Destination service logs, resource access, endpoint telemetry and DC context | Event 4624, NTLM operational auditing, endpoint/process telemetry and network records |
| Primary recovery focus | Coordinated KRBTGT password reset twice and Active Directory validation | Investigate and protect the service account, affected host and resource permissions | Audit NTLM dependencies, then restrict where feasible and improve credential hygiene |
A practical correlation workflow for defenders
- Classify the artifact. Decide whether the evidence concerns a TGT, a service TGS or password-hash authentication. Do not classify by the attacker’s apparent privilege alone.
- Identify the protocol path. Determine whether the event is Kerberos, NTLM or another mechanism. This narrows the relevant logs and prevents Pass-the-Ticket and PtH from being conflated.
- Map the scope. For a Golden Ticket, map domain identities and privileged resources. For a Silver Ticket, map the service and host. For PtH, map the account and every reachable system involved.
- Collect all required locations. Use domain-controller logs for Kerberos context, destination-host logs for service use, and endpoint telemetry for process and credential activity. No single location is complete for all three techniques.
- Test against normal behavior. Check account, host, source address, encryption, schedule, service and policy baselines. Mark each anomaly as suspicious until corroborated.
- Contain according to the path. Do not apply a KRBTGT reset to a service-account-only incident or treat NTLM restriction as a substitute for investigating forged Kerberos tickets.
Making the log sources work together
The most useful detection design follows the authentication path instead of forcing every alert into one rule. On domain controllers, retain Kerberos request and service-ticket records long enough to compare a service use with the expected preceding activity. On destination servers, collect authentication and resource-access records because a Silver Ticket can be created and presented locally without a KDC exchange. On endpoints, preserve process, network and security-tool telemetry that can explain how a suspicious identity was used.
Normalize account names, computer names, source addresses and timestamps before correlation. A hostname alias, NAT address or clock difference can otherwise make a legitimate sequence look broken. Conversely, a clean-looking sequence should not overrule evidence that the source workstation, privilege level or service account is outside its established pattern.
Retention and collection gaps are part of the confidence assessment. If event 4769 was not collected, or if the destination service has no detailed authentication log, record that limitation explicitly rather than treating missing data as proof that no request occurred. The same principle applies to endpoint telemetry: absence of Sysmon process-access data means the source is unavailable, not that credential or ticket activity was absent.
Questions that often change the investigation
Does a Golden Ticket always produce a suspicious event? No. Detection depends on the ticket’s characteristics, subsequent use and available telemetry. Anomalous lifetime or encryption, a missing expected request sequence and unusual privileged access become more persuasive when they occur together.
Can a Silver Ticket be detected on a domain controller? Sometimes, but not reliably from DC data alone. The KDC may never see creation or use, so service-host authentication and resource-access logs are essential. A missing KDC event is a clue that must be weighed against collection gaps and normal protocol behavior.
Is RC4 evidence of a Golden Ticket? Not by itself. RC4 can be legitimate where domain configuration or compatibility requires it. The useful question is whether the encryption type is unexpected for that account, service and policy baseline.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Is every unusual NTLM logon Pass-the-Hash? No. NTLM remains legitimate in some compatibility scenarios, and suspicious NTLM behavior may also be associated with reconnaissance, brute force or remote execution. Review event 4624 fields, the NTLM operational log, process context and account-to-host history together.
Why are service-account baselines difficult? Service identities may run on schedules, move during failover or access several resources as part of one application. Baselines should therefore include approved hosts, applications, protocols, maintenance windows and clustered or backup systems rather than a single fixed source address.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Common analytical mistakes
- Calling every RC4 ticket malicious. RC4 may be legitimate in some environments; unexpected use relative to policy is the relevant signal.
- Relying only on domain-controller logs for Silver Tickets. A forged TGS may be created and used without KDC interaction, so the destination host can hold the strongest evidence.
- Treating any NTLM alert as PtH. NTLM also appears in legitimate compatibility scenarios and in activity associated with reconnaissance, brute force or remote execution. Investigate the full context.
- Resetting KRBTGT once and stopping. MITRE’s guidance calls for two coordinated resets, with replication and ticket-lifetime validation.
- Ignoring logging limitations. Missing event collection, short retention or absent service logs reduces confidence and should trigger preservation and instrumentation work, not an assumption about what happened.
- Confusing scope with certainty. Golden Tickets have potentially broad implications, but analysts still need identity, host and authorization evidence. Silver Tickets are narrower, but a powerful service account can make the consequence serious.
Bottom line for incident teams
Use the authentication artifact to choose the investigation: TGT anomalies and KRBTGT recovery for Golden Tickets; service-host and resource evidence for Silver Tickets; NTLM logon, endpoint and account-to-host correlation for Pass-the-Hash. Detection confidence comes from multiple signals aligned with local policy and normal behavior—not from one event, one encryption type or one alert label.
For the authoritative Silver Ticket definition and detection context, see MITRE ATT&CK’s Silver Ticket technique page.
Frequently Asked Questions
How do you detect a Golden Ticket?
Compare ticket lifetime and encryption with domain policy, look for service-ticket activity without a normal preceding TGT request, review unusual logon or privilege records such as events 4672 and 4634, and correlate event 4769 with endpoint process-access telemetry. Treat each as suspicious until identity, host and authorization context corroborate it.
Can a Silver Ticket be detected on a domain controller?
Not reliably from domain-controller logs alone. A forged service ticket can be created and used without contacting the KDC, so investigate the destination service host, its authentication and resource-access logs, the service account’s normal host/resource pattern and the source endpoint.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What is the main difference between Golden and Silver Tickets?
A Golden Ticket is a forged TGT protected by KRBTGT-derived secret material and can support broad domain impersonation. A Silver Ticket is a forged service-specific TGS made with a target service account’s secret, so its scope is tied to that service, resource and host.
Is Pass-the-Hash the same as Pass-the-Ticket?
No. Pass-the-Hash reuses password-hash material, commonly through NTLM-capable authentication. Pass-the-Ticket reuses Kerberos ticket material. The protocols, artifacts and logs differ.
What does event 4624 show in a Pass-the-Hash investigation?
It records a successful logon and can provide the account, logon type, source network address, destination computer, authentication package and process or session context. Those fields must be compared with normal account-to-host behavior; event 4624 alone does not prove PtH.
Should an organization block NTLM immediately?
First use Microsoft’s NTLM auditing policy and the Microsoft-Windows-NTLM operational log to identify legacy applications, devices and workflows. Then evaluate restriction or blocking controls supported by the Windows versions in the fleet. Auditing records traffic but does not mitigate it.
Free tools Windows power users keep installed
One-click scans. No signup required.
How many KRBTGT resets are recommended after a Golden Ticket concern?
MITRE recommends two coordinated resets of the built-in KRBTGT account password. Treat the change as Active Directory recovery: verify replication, account for ticket lifetimes and validate legitimate authentication after each reset.
What should be rotated after a suspected Silver Ticket?
Investigate and protect the target service account according to the organization’s service-account procedure, while scoping the affected host, service, resource permissions and reachable systems. The response is different from a KRBTGT recovery unless the domain secret is also suspected.
The Bottom Line
Golden Tickets forge TGTs, Silver Tickets forge service-specific TGS tickets, and Pass-the-Hash reuses password-hash authentication material. Use separate but correlated detection paths: domain-controller and endpoint evidence for Golden Tickets, destination-host evidence for Silver Tickets, and NTLM logon plus endpoint and account-to-host context for PtH. No single event, encryption type or alert label is conclusive without a local baseline.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
