A Silver Ticket is forged for one specific service, while a Golden Ticket is forged from the KRBTGT account and can grant domain-wide access. Silver Ticket abuse is narrower but can be stealthier because it may avoid KDC checks after creation. Golden Ticket abuse is broader, enabling impersonation, lateral movement, and persistence across the domain.
Why This Matters for Security Teams
Silver Ticket and golden ticket attack both abuse Kerberos trust, but they differ in scope, stealth, and blast radius. That matters because defenders often look for password spraying or token theft while missing forged tickets that can keep working even when normal authentication controls appear healthy. In practice, the danger is not just initial access, but how long an attacker can impersonate users or services without touching the KDC.
This is why identity telemetry, ticket lifetime monitoring, and service-account hardening belong alongside broader NHI governance. NHI Mgmt Group’s Ultimate Guide to NHIs — Key Challenges and Risks notes that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which is a useful reminder that privilege abuse often starts with weak identity hygiene. The attack pattern is also consistent with MITRE ATT&CK Enterprise Matrix techniques for forged authentication material and lateral movement.
In practice, many security teams encounter ticket forgery only after unusual domain activity has already been attributed to “normal” authenticated traffic.
How It Works in Practice
A Silver Ticket is a forged Kerberos service ticket for one specific service, such as CIFS, HTTP, or MSSQL. To build it, an attacker typically needs the service account hash, because that hash can be used to create a ticket that the target service will accept. The key limitation is scope: the forged ticket is valid for that service only, but the key advantage is stealth, since the attack can bypass the KDC after the ticket is created.
A golden ticket is more powerful because it is forged from the KRBTGT account secret. That account signs the Kerberos Ticket Granting Ticket path for the domain, so a forged TGT can be used to request service tickets across the environment. The result is domain-wide impersonation potential, long-lived persistence, and a much broader lateral movement path. For defenders, the operational difference is that Silver Ticket abuse often appears as isolated service misuse, while Golden Ticket abuse can look like legitimate domain authentication from many systems.
Current guidance suggests prioritising:
- Monitoring for abnormal Kerberos ticket lifetimes and unusual service principal use.
- Restricting and rotating highly privileged service account secrets.
- Reducing reliance on long-lived static credentials where possible.
- Correlating ticket use with host, user, and time-of-day context.
For a broader view of identity compromise patterns, see 52 NHI Breaches Analysis and CISA cyber threat advisories. These controls tend to break down in environments with legacy domain trust, over-privileged service accounts, and limited Kerberos logging because forged tickets can blend into routine authentication noise.
Common Variations and Edge Cases
Tighter Kerberos monitoring often increases operational overhead, requiring organisations to balance detection sensitivity against the risk of alert fatigue. That tradeoff is especially visible in environments with many service accounts, third-party integrations, or multi-domain trust relationships.
There is no universal standard for ticket expiry tuning that fits every environment, but best practice is evolving toward shorter credential lifetimes, better secret rotation, and stronger service-account segmentation. A Silver Ticket may be enough for quiet access to one high-value application, while a Golden Ticket is more likely to be used for persistent domain control, but both can coexist in the same intrusion chain. In mature investigations, teams should also compare Kerberos anomalies against adjacent signals such as unusual privilege escalation, remote service creation, and authentication from unexpected hosts. For practical NHI governance context, Ultimate Guide to NHIs — Why NHI Security Matters Now is a useful reference, especially when paired with Anthropic — first AI-orchestrated cyber espionage campaign report for understanding how automation accelerates credential abuse.
The distinction becomes less useful when attackers chain forged tickets with stolen privileged session data, because the real issue then is sustained trust abuse rather than ticket type alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-1 | Kerberos ticket forgery is an access control failure tied to identity assertions. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Service-account secret exposure enables Silver Ticket creation and persistence. |
| NIST Zero Trust (SP 800-207) | Zero Trust reduces implicit trust in forged tickets and lateral movement paths. | |
| NIST AI RMF | GOVERN | Kerberos abuse shows why identity trust needs explicit governance and accountability. |
| CSA MAESTRO | Service identity misuse maps to runtime trust and workload protection concerns. |
Assign clear ownership for service identities and monitor authentication risk as an ongoing governance issue.
Related resources from NHI Mgmt Group
- What is the difference between a normal Kerberos ticket issue and a Golden Ticket attack?
- Why do Silver Ticket attacks remain dangerous even though they are narrower than Golden Ticket attacks?
- What is the difference between prompt injection risk and identity abuse in agents?
- What is the difference between SAST and DAST for security teams?
