Attackers use Steal or Forge Kerberos Tickets to impersonate users or services without repeatedly presenting passwords. With stolen tickets or forged tickets, they can move laterally and access resources as a trusted principal. Defenders should protect ticket-signing secrets, limit privileged logons, and investigate unusual Kerberos activity or long-lived access.
How stolen or forged Kerberos tickets change the attack path
Kerberos tickets let a trusted principal prove identity without re-entering a password each time. When attackers steal a valid ticket or forge one that the service accepts, they inherit that trust path. The practical effect is impersonation at scale: access that looks legitimate to the destination service, often with far less friction than password theft alone.
That is why ticket abuse is so valuable for post-compromise movement. An attacker does not need to keep reauthenticating in the normal way if the ticket is already accepted, and the abuse can blend into routine Kerberos traffic unless defenders look for the surrounding pattern of misuse.
What attackers actually do with stolen or forged tickets
With a stolen ticket, an attacker replays an existing proof of identity to services that trust it. With a forged ticket, they create a ticket that appears to come from a trusted source and then use it to impersonate a user or service account. In both cases, the goal is the same, extend access without needing the original password every time.
That access is especially useful for lateral movement because Kerberos often protects access to internal services, file shares, administrative functions, and application back ends. If the ticket represents a privileged principal, the attacker can often move from one system to another while appearing to be an authenticated insider.
For a practical walkthrough of the abuse patterns, defenders often start with the Kerberos Security Guide, because it covers the specific ticket attacks, resets, and detection points that matter when a ticket is reused or forged. When the consequence is broader lateral movement, the Lateral Movement Guide helps connect ticket abuse to the next hop an attacker is trying to reach. For incident handling across the identity attack chain, the Identity Threat Detection and Response (ITDR) Guide is useful because it ties Kerberos abuse to the detections and response steps that surface identity compromise.
What defenders should watch, harden, and investigate
Kerberos ticket abuse usually becomes visible through abnormal ticket issuance, unusual service use, or access patterns that do not fit the account’s normal role. Long-lived access, repeated access from the same principal across many hosts, or privileged use at odd times are all signals worth correlating with authentication and directory activity.
Defensive focus should stay on three things: protect the signing material that makes forged tickets possible, constrain where privileged accounts can log on, and investigate whether the ticket abuse is only a replay problem or a broader compromise of the principal itself. If the attacker can mint or reuse trust, the damage often persists until the trusted material is reset or revoked.
The State of NHI & AI Agent Breach Report 2026 is relevant here because it shows how stolen secrets and trusted credentials are repeatedly used as the entry point to lateral movement and access expansion. Even though the mechanics differ from one environment to another, the pattern is the same: once a trusted artifact is exposed, attackers try to turn that trust into repeatable access.
Practical containment when Kerberos tickets may be in play
Once ticket abuse is suspected, the first question is whether the attacker only replayed an existing ticket or also obtained the material needed to forge new ones. That distinction matters because replay can often be contained by expiring sessions and removing the stolen artifact, while forgery implies a broader trust reset and deeper compromise review.
In practice, defenders should treat privileged ticket abuse as a credential exposure event, not just an authentication anomaly. If the attacker had the ability to impersonate a highly trusted principal, rotate the relevant signing material, narrow privileged logon pathways, and review whether other services accepted the same trust chain before assuming the problem is contained.
Risk and Threat Considerations
Kerberos ticket theft and forgery are dangerous because they turn one successful compromise into repeated trusted access. The main risk is not the ticket itself, but the trust it carries, which can let an attacker move laterally, reach sensitive systems, and blend in with legitimate authentication traffic.
Failure mechanism: If the attacker can replay a valid ticket or forge one that a service accepts, they can bypass repeated password checks and operate as the impersonated principal until the ticket expires or the trust material is changed.
Impact: This can expose internal services, privileged administrative paths, and high-value data, while making compromise harder to distinguish from normal Kerberos activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1550.003 — Pass the Ticket | Directly covers stolen Kerberos ticket replay for impersonation and lateral movement. |
| T1558.001 — Golden Ticket | Covers forged Kerberos tickets that abuse trusted ticket-signing material. | |
| Recommendation — Map ticket replay activity to T1550.003 and hunt for downstream lateral movement. Correlate forged-ticket indicators with KRBTGT compromise and reset the trust chain. | ||
| CIS Controls v8 | CIS-5 — Account Management | Kerberos ticket abuse depends on overprivileged accounts and weak lifecycle control. |
| Recommendation — Restrict privileged accounts and remove unnecessary standing access paths. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Kerberos ticket abuse hinges on lifecycle control of ticketing and signing material. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Kerberos abuse is usually found through anomalous ticket and access telemetry. | |
| Recommendation — Rotate and protect ticket-signing material and invalidate exposed authenticators. Review Kerberos and directory logs for anomalous ticket use and privileged access. | ||
Practitioner Guidance
What to verify: Confirm whether the suspicious activity is limited to one service or reflects broader trust abuse across multiple hosts. The key evidence is whether the same principal is being accepted in places its normal behavior would not explain.
Decision rule: If the ticket can authenticate to privileged services, treat the event as a high-confidence identity compromise and prioritise containment over narrow detection tuning. If the suspicious access is limited and time-bound, focus first on session expiry and scoped investigation.
Practitioner takeaway: The critical judgment is to treat Kerberos ticket abuse as trust abuse, not just authentication abuse, because the response must match the level of impersonation the attacker achieved.