Pass The Ticket Attack

A Pass the Ticket attack is a Kerberos abuse technique where an attacker reuses stolen tickets to impersonate a legitimate user. Instead of cracking a password, the attacker presents a valid ticket to gain access, move laterally, or escalate privileges in Active Directory environments.

Expanded Definition

pass the ticket attack is a Kerberos ticket replay technique used in Active Directory environments after an attacker has obtained a valid ticket from memory, disk, or a compromised host. The attacker does not need to guess the user’s password; instead, they inject or present the stolen ticket to impersonate that identity until the ticket expires or is invalidated. In practice, this sits within broader credential theft and lateral movement patterns described in the MITRE ATT&CK Enterprise Matrix, but the NHI security lens matters because the ticket is itself a live bearer artifact. Definitions vary across vendors on whether this is treated as an authentication abuse, privilege escalation, or post-compromise persistence technique, but the operational behavior is consistent: valid Kerberos material is reused outside its intended session context. NHI Management Group treats this as a governance failure as much as a technical one, because ticket theft usually follows weak endpoint protection, poor service account hygiene, or excessive privilege. The most common misapplication is assuming Kerberos tickets are harmless once issued, which occurs when defenders monitor password events but ignore ticket theft and replay.

Examples and Use Cases

Implementing detection and containment for ticket abuse rigorously often introduces operational friction, because stronger session monitoring and tighter ticket lifetimes can increase authentication failures and helpdesk noise while reducing attacker dwell time.

• An attacker compromises a workstation, extracts a domain user’s Kerberos ticket from memory, and uses it to access file shares without triggering password reset alerts.
• After stealing a ticket from a privileged administrator session, the attacker reuses it to move laterally into a server tier and stage further compromise.
• A red team validates whether endpoint hardening can block ticket extraction and replay, then maps findings to the Ultimate Guide to NHIs — Key Challenges and Risks and Top 10 NHI Issues for governance gaps.
• A security team correlates unusual service access with Kerberos ticket reuse, using guidance from CISA cyber threat advisories and the 52 NHI Breaches Analysis to prioritize response.
• An incident responder identifies that the ticket was replayed after privilege escalation, showing that compromise persistence can outlast a password change if the session artifact is still valid.

Why It Matters in NHI Security

Pass the Ticket attacks matter because they expose a blind spot in identity defense: the organization may believe it has secured credentials while an attacker is operating with an already-issued authentication artifact. In NHI terms, this is a reminder that access material, not just passwords, must be governed as a secret with lifecycle controls, monitoring, and revocation logic. NHI Management Group research shows that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, and the same control weaknesses that enable secret abuse also make ticket theft harder to detect. The Ultimate Guide to NHIs highlights that 97% of NHIs carry excessive privileges, which increases the blast radius when an attacker reuses trusted access material. Defenders should pair identity telemetry with endpoint controls, session awareness, and Zero Trust assumptions rather than relying on password-centric detection alone. Relevant mapping also appears in the OWASP NHI Top 10, where credential misuse and overprivileged access are recurring failure modes. Organisations typically encounter the impact only after unusual lateral movement or privilege abuse is investigated, at which point ticket replay becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Attack Surface Management
• What is the difference between a normal Kerberos ticket issue and a Golden Ticket attack?
• Golden Ticket Attack
• Pass-the-Cookie Attack