Silver Ticket
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
AN0675 is the only analytic and it offers two log sources, neither of which can carry a Silver Ticket. The Windows Security leg is scoped to EventID 4672 and 4634 only. 4672 carries SubjectUserSid, SubjectUserName, SubjectDomainName, SubjectLogonId and PrivilegeList; 4634 carries TargetUserSid, TargetUserName, TargetDomainName, TargetLogonId and LogonType. Neither event carries a service name, a ticket encryption type, ticket options, or any TGT/TGS distinction — all of that lives on 4768/4769/4770, which this brief does not offer — so the analytic's stated discriminators ('malformed fields in logon events', 'TGS requests without interaction with the KDC') have no field to be written against. This is the identical finding already recorded in the published T1558 parent rule, which declined the same 4672/4634 leg for the same reason. […]
What the technique is
Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets. Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource (e.g. MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult. Password hashes for target services may be obtained using OS Credential Dumping or Kerberoasting.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0675
Detects forged Kerberos Silver Tickets by identifying anomalous Kerberos service ticket activity such as malformed fields in logon events, TGS requests without interaction with the KDC, and access attempts using service accounts outside expected hosts/resources. Also monitors suspicious processes accessing LSASS memory for credential dumping.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.