Kerberos tickets are trusted because they're signed by a domain secret. Steal that secret and you can forge tickets at will - the endgame of AD compromise.
Golden vs Silver
- Golden Ticket - forged with the KRBTGT account's hash. It's a self-made TGT, so the attacker can request service tickets for anything, as anyone (including a fake "Domain Admin"), with a validity they choose. Total domain control.
- Silver Ticket - forged with a service account's hash. Narrower: it grants access to that one service (e.g. a specific server's CIFS/HTTP), but it never touches the DC, so it's even quieter.
Why they're brutal to detect
A forged ticket looks valid to every service - the crypto checks out. There's often no failed auth, no anomaly at the moment of use. Detection leans on subtle tells.
Detection + response
- Anomalous ticket lifetimes / encryption (RC4 where AES is expected), tickets for accounts that don't exist, or TGS requests with no preceding TGT (Silver ticket).
- Behavior after the fact - a "user" suddenly performing privileged actions from an odd host.
- The only real remediation for a Golden Ticket is rotating the KRBTGT password twice (invalidating all existing tickets). If KRBTGT was dumped, assume full compromise and plan a careful recovery.