Use Alternate Authentication Material: Pass the Ticket

Defense Evasion [Mitre]

Adversaries may "pass the ticket" using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.

When …

Valid Accounts: Domain Accounts

Defense Evasion [Mitre]

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Adversaries may …

Valid Accounts: Local Accounts

Defense Evasion [Mitre]

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Local Accounts may also be abused to elevate privileges and harvest credentials …

Search For Content

Search Result

Use Alternate Authentication Material: Pass the Ticket

Defense Evasion [Mitre]

Valid Accounts: Domain Accounts

Defense Evasion [Mitre]

Valid Accounts: Local Accounts

Defense Evasion [Mitre]