Detect Golden Tickets by correlating domain-controller events 4768 and 4769 with identity, ticket, and timing anomalies; detect Silver Tickets by adding destination-service and endpoint telemetry because a forged service ticket can be used without contacting a domain controller.
Why Golden Ticket and Silver Ticket detection are different
Both attacks abuse Kerberos, but they leave evidence at different points in the authentication flow. A Golden Ticket is a forged ticket-granting ticket (TGT). The attacker can use it to request service tickets while bypassing normal TGT issuance. A Silver Ticket is a forged service ticket for a particular service account and resource. It can be presented directly to that service without a request to the Key Distribution Center (KDC).
As an Amazon Associate I earn from qualifying purchases.
That distinction determines where to look. Domain-controller Security logs are essential for Golden Ticket investigations, especially when you relate Event 4768 (TGT requested) to Event 4769 (service ticket requested). They are not enough for Silver Tickets: the destination server, the service, and the client endpoint may contain the decisive evidence. The CISA and partner-agency guide cautions that forged tickets can be made to look legitimate, so every indicator is an investigation lead rather than proof by itself.
Build the telemetry required for detection
Collect events from every domain controller
Enable Kerberos auditing on all domain controllers and forward Security events 4768 and 4769 to a central analysis system. A detector that receives events from only one domain controller can mistake normal cross-DC activity for an attack or miss the event that explains a service-ticket request. Central collection also lets you compare the requesting client, account, destination service, and timestamps across the domain.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- Verify that every current domain controller is sending 4768 and 4769.
- Measure event retention against the longest investigation window your team uses.
- Check time synchronization on domain controllers, endpoints, and the analysis platform; incorrect clocks can break event correlation.
- Record collection gaps, maintenance periods, and domain-controller outages so analysts can distinguish missing data from a missing Kerberos step.
Event 4768 has a documented schema update for supported Windows Server systems that received the cumulative update released on January 14, 2025, or a later cumulative update. Confirm the event version and fields actually emitted in your environment before writing parsers or rules. The Microsoft event 4768 reference lists the fields and version information.
Know what the two events represent
| Event | Meaning | How it helps |
|---|---|---|
| 4768 | A Kerberos TGT was requested from a domain controller. | Establishes the normal first step for a Kerberos session and supplies account, client, domain-controller, and encryption context. |
| 4769 | A Kerberos service ticket (TGS) was requested. | Shows access to a particular service and can be related to the earlier TGT request. |
MITRE classifies these records as Active Directory Credential Request data in its DC0084 data component. The events are valuable only when their coverage and fields are understood; a parser written for an older event version may silently discard useful data.
A step-by-step detection workflow
1. Establish a baseline before alerting
Profile normal Kerberos behavior for users, computers, service accounts, applications, and administrative tools. Include the domain controllers they normally contact, the hosts from which they authenticate, the services they access, common encryption types, and ordinary ticket-lifetime ranges. Baselines should reflect business cycles such as overnight jobs, help-desk activity, software deployment, and disaster-recovery exercises.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Do not set a universal threshold from one environment. Legacy systems may legitimately use older encryption, service accounts may have very different access patterns, and a complete event stream may not yet be available. Store the baseline with its time period and coverage so an analyst knows whether an outlier is genuinely new.
2. Correlate 4768 and 4769 records
- For each 4769 service-ticket request, identify the account, requesting host or address, destination service, domain controller, and timestamp.
- Search the collected 4768 events for a plausible TGT request by the same principal and client context before the service-ticket request. Account for requests handled by a different domain controller.
- Use a time window appropriate to the environment rather than an arbitrary single-second match. Record the window and any collection gaps used in the decision.
- Prioritize 4769 requests with no plausible preceding 4768, then check whether the absence is explained by incomplete logging, another authentication path, clock error, or an event from a domain controller that was not collected.
In ordinary Kerberos activity the TGT step generally precedes the service-ticket step. A Golden Ticket can bypass issuance of the TGT at the KDC, which is why a service-ticket request without an expected TGT is suspicious. It is not conclusive: the government guidance specifically recommends treating this correlation as a lead and validating it with other evidence.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Test identity and authorization consistency
Compare the identity represented in the ticket and related logon records with the current directory. Investigate a username, security identifier, or principal that does not exist, has been deleted, or conflicts with the account that actually performed the activity. Also compare claimed authorization data and group membership with the account’s directory memberships at the time of the event.
- A ticket names a principal that is not present in Active Directory.
- Group membership or authorization data in the ticket grants rights the directory object does not have.
- A disabled, expired, or otherwise inactive account appears to authenticate successfully without a corresponding approved exception.
- Fields that should contain consistent Kerberos or logon values are malformed, blank, or internally contradictory.
Directory changes, replication delay, migration work, and special application identities can explain some mismatches. Preserve the directory snapshot and replication state used for comparison instead of evaluating the ticket against a later state.
4. Examine lifetime and encryption behavior
Review the ticket’s start time, end time, and lifetime against the account, domain, and service baseline. A ticket that remains valid for an unusually long period or has times that do not fit the surrounding logons deserves investigation. Check encryption types as well. Unexpected RC4 use in an environment that normally uses stronger encryption, a sudden downgrade for one identity, or an encryption type never seen for that service can indicate forgery or credential misuse.
Microsoft Defender for Identity describes Golden Ticket alerts for ticket anomalies, time anomalies, and encryption behavior. Its encryption-behavior detection learns normal user and computer encryption patterns and has a five-day learning period after domain-controller monitoring begins; alerts during or immediately after that period should be interpreted in light of the incomplete baseline. See the Microsoft Defender for Identity classic security-alert documentation.
Encryption and lifetime alone should not trigger a containment action. Legacy applications, trusts, old operating systems, and manually configured services can create legitimate outliers. Combine the ticket field with the requesting host, account history, directory state, and resource accessed.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
5. Add endpoint and service evidence for Silver Tickets
For each service-ticket anomaly, pivot to the destination server and the client endpoint. Look for a successful service logon or authorization decision that has no corresponding KDC request, a malformed ticket field, or use of a service account from a host that account never normally uses. Compare the resource accessed with the service account’s documented scope.
- Review logons on the destination service, including the account, source host, process or application context when available, and exact time.
- Check endpoint security telemetry for the process that initiated the connection and for credential access or lateral-movement activity around it.
- Compare the service account’s normal hosts, services, schedules, and resource paths with the observed request.
- Investigate access to a server, share, database, or application outside the account’s normal authorization boundary.
MITRE documents the Silver Ticket technique as T1558.002 and notes that a forged service ticket can be used without KDC interaction. Therefore, the absence of a 4769 request is compatible with a Silver Ticket but cannot establish one. A service may log a successful authentication even though the domain controllers have no matching request.
Indicators that deserve priority
| Signal | Most relevant attack | Why it matters | Validation step |
|---|---|---|---|
| 4769 without a plausible preceding 4768 | Golden Ticket | The normal TGT-to-service-ticket sequence is incomplete. | Check all domain controllers, clocks, retention, and alternative authentication paths. |
| Principal does not exist or conflicts with directory state | Golden Ticket or Silver Ticket | Forged authorization can name a nonexistent identity or claim groups the account lacks. | Compare the ticket and logon identity with a time-appropriate directory snapshot. |
| Unusual lifetime or ticket times | Golden Ticket or Silver Ticket | Forged tickets may have validity periods unlike the domain or service baseline. | Check policy, service configuration, clock health, and approved exceptions. |
| Unexpected encryption type or downgrade | Both | Encryption behavior that differs from the account, computer, or service pattern can indicate abuse. | Use a mature baseline; investigate legacy dependencies before changing configuration. |
| Malformed or blank ticket fields | Both | Inconsistent fields can indicate a fabricated ticket or parser incompatibility. | Verify the event version and inspect the raw event alongside endpoint evidence. |
| Service-account use from an unfamiliar host | Silver Ticket | A forged service ticket may be presented directly from a compromised endpoint. | Confirm ownership, scheduled tasks, deployment activity, and process telemetry. |
| Access outside the service account’s normal resource scope | Silver Ticket | The ticket may be used to reach a service the account does not ordinarily access. | Compare authorization, resource logs, and the account’s approved role. |
No single row proves ticket forgery. The strongest cases combine an abnormal event sequence with an identity inconsistency and endpoint or resource evidence.
Golden Ticket versus Silver Ticket detection coverage
| Comparison axis | Golden Ticket | Silver Ticket |
|---|---|---|
| Forged object | Ticket-granting ticket (TGT) | Service ticket for a particular service |
| Primary visibility point | Domain-controller/KDC events, especially 4768 and 4769 | Destination service and endpoint logs, supplemented by domain-controller events |
| Core correlation | Expected TGT request followed by service-ticket requests | Service authentication and resource access, even when no KDC request exists |
| Useful anomaly classes | Missing TGT step, nonexistent account, inconsistent groups, lifetime, time, and encryption | Malformed fields, unexpected service-account host, unusual resource, lifetime, time, and encryption |
| Main false-positive exposure | Incomplete DC collection, clock differences, alternate authentication, legacy encryption | Shared service accounts, scheduled jobs, undocumented application hosts, and sparse service logging |
| Operational prerequisites | Auditing and centralized retention on every DC; event-schema support | Destination-service and endpoint telemetry plus a reliable service-account baseline |
How to investigate an alert without overreacting
Start with the raw evidence
Save the original 4768, 4769, logon, service, and endpoint records before normalizing or enriching them. Record the domain controller that emitted each event, event version, account identifiers, client address or host, destination service, encryption type, ticket times, and collection timestamp. A normalization error can make a valid event appear blank or malformed.
Reconstruct the identity and host story
Determine which account key was used, whether it existed at the time, and where the request originated. Review recent password changes, account disablement, privilege changes, domain-controller changes, and administrator activity. On the source host, identify the process and user session responsible; on the destination, identify what was accessed and whether the action succeeded.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Grade confidence from independent signals
- Low confidence: only a missing 4768, with known collection gaps or clock problems.
- Moderate confidence: a missing sequence plus an unusual lifetime, encryption type, or host pattern.
- High confidence: several independent inconsistencies, such as a nonexistent principal or impossible group claim combined with successful access from an unexpected host and supporting endpoint evidence.
This grading is an investigation aid, not a substitute for your incident-response severity model. Preserve evidence at every level because an apparently weak ticket anomaly can become important when linked to credential theft or lateral movement.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common detection failures and fixes
Relying only on a single domain controller
Failure: A rule declares every 4769 without a local 4768 suspicious. Fix: Correlate across all domain controllers and document collection completeness, replication, and time synchronization.
Treating a missing event as proof
Failure: Analysts close or contain an incident solely because no TGT request was found. Fix: Check retention, parser compatibility, alternate authentication, and endpoint evidence before making a verdict.
Alerting on RC4 or long lifetimes without context
Failure: A legacy application generates repeated false positives. Fix: Baseline by account, computer, service, and application; investigate approved exceptions and changes rather than using a domain-wide rule.
Using only KDC telemetry for Silver Tickets
Failure: A forged service ticket is missed because no 4769 exists. Fix: Monitor destination-service authentication, resource access, and endpoint processes, and map normal service-account use.
Ignoring event-schema changes
Failure: A parser drops fields after a supported server receives a newer cumulative update. Fix: Test against the event version emitted after the January 14, 2025 update and later updates, and retain the raw event for verification.
Resetting credentials without coordination
Failure: An emergency KRBTGT or service-account change is made without checking replication and ticket dependencies. Fix: Escalate through the incident-response process and use Microsoft’s current Active Directory guidance before changing keys.
Containment and recovery considerations
A credible forged-ticket finding can indicate compromise of the KRBTGT secret, a service-account key, or a host that can obtain those credentials. Preserve domain-controller and endpoint telemetry, identify how the key could have been acquired, and scope other accounts and systems that may have been accessed.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe Microsoft Windows Server guidance published December 9, 2025 and the CISA-partner guide discuss coordinated KRBTGT recovery, including changing the KRBTGT password twice after suspected compromise. That is not a stand-alone command or an action to perform blindly: replication health, ticket expiration, domain-controller availability, and operational dependencies must be validated using the current Microsoft instructions. Apply the same discipline to service-account key rotation, including inventorying applications and scheduled tasks that depend on the account.
What a mature detection program looks like
- All domain controllers send complete 4768 and 4769 telemetry to centralized retention.
- Event versions and parser behavior are tested after Windows cumulative updates.
- Identity, authorization, encryption, lifetime, host, and resource baselines are maintained by account and service rather than as one global threshold.
- Silver Ticket coverage includes destination servers and endpoints, not only KDC logs.
- Alerts preserve raw evidence and provide an analyst path from event to directory object, source host, destination service, and process.
- Incident responders have a tested process for key compromise, replication validation, credential rotation, and post-containment monitoring.
The practical objective is not to find one magic field. It is to make forged-ticket use difficult to hide across identity records, Kerberos sequence, ticket metadata, service behavior, and endpoint activity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
