A Diamond Ticket is a Kerberos ticket forgery technique that starts with a legitimate ticket and then decrypts, modifies, and re-encrypts it. The result can preserve normal ticket characteristics while changing identity or authorization details, which makes it more difficult to detect than crude from-scratch forgery.
What a Diamond Ticket Is
A Diamond Ticket is a Kerberos ticket forgery technique that starts with a valid ticket, then alters selected fields and re-encrypts it so the result looks more legitimate than a crude forged ticket.
The key idea is not merely forgery, but preservation of normal ticket structure while changing the identity or authorization context carried inside it. That makes the abuse harder to spot with basic anomaly checks than a ticket created from scratch.
How the Technique Changes the Attack Path
Diamond Ticket abuse sits in the credential-forgery and Kerberos trust path. Because the attacker begins with an authentic ticket, the modified artifact may retain expected timestamps, encryption characteristics, and other structural details that defenders often use to separate normal activity from obviously fake material.
This matters operationally because Kerberos tickets are not just access tokens, they are trust-bearing authentication artifacts. If an adversary can modify a ticket without breaking the surrounding expectations, they may preserve access long enough to move laterally or impersonate a different principal more convincingly.
Why It Is Harder to Detect
Compared with blunt ticket forgery, Diamond Ticket abuse is stealthier because the ticket often still “looks” like a ticket issued through ordinary flows. Detection therefore depends on validating more than surface format, including whether the ticket content, issuer context, and authorization claims align with the expected identity lifecycle.
Security teams should treat this as a trust-subversion problem, not just a parsing problem. When authentication material is valid enough to pass casual inspection but altered enough to change access, the gap is usually in trust validation, privilege boundaries, or downstream authorization checks.
Where It Fits in Kerberos Security
Diamond Ticket is one technique within a broader family of Kerberos ticket manipulation and identity abuse. It is closely related to other forged-ticket behaviors, but its practical distinction is that it begins with a legitimate ticket and preserves enough of the original structure to appear normal while still changing effective access.
For practitioners, the important takeaway is that ticket integrity and ticket origin both matter. If monitoring only asks whether a Kerberos artifact is syntactically valid, it can miss a ticket that was validly rooted but maliciously modified into something with different authorization consequences.
Risk and Threat Considerations
Diamond Ticket abuse creates a material identity-security risk because it can convert legitimate Kerberos trust into covert privilege manipulation. The threat is not just initial access, but the ability to retain or reshape that access in a way that blends into ordinary authentication traffic.
Failure mechanism: An attacker obtains a valid Kerberos ticket, alters authorization-relevant fields, and re-encrypts the result so the forged ticket still resembles a normal artifact while carrying changed access context.
Impact: This can support stealthier impersonation, privilege misuse, and lateral movement, especially where defenders rely on ticket appearance rather than deeper validation of identity and authorization claims.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1558 — Steal or Forge Kerberos Tickets | Diamond Ticket is a Kerberos ticket forgery technique. |
| Recommendation — Map Kerberos ticket-forgery activity to T1558 and hunt for forged-ticket indicators across authentication telemetry. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Kerberos tickets are authentication artifacts whose lifecycle and integrity affect access decisions. |
| IA-2 — Identification and Authentication (Organizational Users) | Ticket forgery subverts the identity proof used for organizational access. | |
| AU-2 — Event Logging | Detecting forged or modified tickets depends on correlated authentication and access logging. | |
| Recommendation — Enforce IA-5 practices to protect and rotate authenticators and reduce ticket-abuse exposure. Apply IA-2 controls to strengthen authentication assurance and validate identity before granting access. Log Kerberos issuance and use events so ticket anomalies can be correlated with downstream access. | ||
Practitioner Guidance
What to watch for: Focus on ticket behavior that is technically valid but inconsistent with normal issuance, renewal, or principal-to-service relationships. A modified ticket may evade simplistic detections, so correlation across authentication events, authorization decisions, and endpoint activity becomes more important than ticket inspection alone.
Governance implication: Treat Kerberos ticket abuse as an identity integrity problem, not just an authentication problem. The control objective is to reduce the opportunity for altered tickets to translate into trusted access without strong corroboration from the broader identity stack.
Related resources from NHI Mgmt Group
- Why is a Diamond Ticket more difficult to detect than a classic forged Kerberos ticket?
- How should teams respond when a secret is found in a support ticket?
- How should identity teams move from ticket queues to product ownership?
- When does ticket-based access management become too slow for NHI governance?
