Security teams can detect Pass the Cache by looking for Kerberos ticket use from a host or account that should not already hold valid cached credentials. Watch for lateral movement with little or no password-based authentication, unusual service access after interactive logon, and logons from endpoints that recently showed credential theft activity. Pair host telemetry with authentication logs and ticket-related anomalies.
What makes Pass the Cache detectable in practice?
Pass the Cache becomes visible when a system accepts Kerberos-based access that does not fit the normal credential history for the account, endpoint, or session. The signal is usually behavioral, not a single signature: the cache is being reused for access that should have required fresh interactive authentication, or it appears on a host that should not already possess a usable ticket set.
That means the detection problem is really about correlation. Security teams need to compare where the ticket appears, which account used it, what the host was doing just before the access, and whether the activity matches normal remote administration or looks like lateral movement.
Which telemetry matters most?
The most useful data is the combination of endpoint telemetry and authentication logs. Host telemetry helps show process lineage, recent credential theft activity, remote execution, and unusual service access. Authentication logs help confirm whether the access sequence involved ticket-based reuse rather than a normal password, MFA, or federated sign-in flow.
Look for patterns such as a logon on one endpoint followed by service access from another system with no matching password event, or Kerberos ticket use that begins soon after an alert for credential dumping, token theft, or suspicious memory access. The more complete your visibility into session creation, ticket usage, and remote service access, the easier it is to distinguish legitimate cache reuse from abuse.
Detections are stronger when they focus on outliers: accounts that rarely authenticate from a given host, endpoints that should not hold reusable credentials, and service access that happens shortly after a workstation compromise. A single event is often weak evidence, but a sequence of host compromise, ticket reuse, and lateral access is much more actionable.
How do you separate legitimate cache use from abuse?
Kerberos ticket use is normal in many Windows environments, so the key is not to flag every ticket. The question is whether the ticket use is consistent with the account’s role, the endpoint’s trust level, and the timing of prior activity. Administrative jump hosts, managed service workflows, and long-lived sessions can all create false positives if you only look at authentication method.
Useful discriminators include whether the account should already have valid cached credentials, whether the source host recently showed signs of compromise, and whether the destination service is one the user typically accesses from that device. A ticket used from a non-standard workstation, after suspicious endpoint behavior, deserves far more scrutiny than the same event from a controlled admin path.
Teams should also pay attention to sequential anomalies: a quiet account suddenly touching multiple services, a cached ticket being used outside the usual time window, or access patterns that suggest the attacker is moving laterally after stealing existing session material. Those are often more meaningful than any single authentication event on its own.
Risk and Threat Considerations
Pass the Cache is dangerous because it can let an attacker reuse existing trust without triggering the same checks that would appear during fresh password authentication. That makes it attractive for lateral movement, especially when the attacker already has a foothold on an endpoint and can harvest or replay cached material.
Failure mechanism: Defenders miss the attack when ticket-based access looks like ordinary Kerberos use, especially if endpoint compromise, unusual host placement, and service access are not correlated in near real time.
Impact: An attacker can expand access quietly, reach additional services, and retain movement options even after the original host compromise is noticed, which increases blast radius and complicates containment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1550.003 — Pass the Ticket | Maps directly to Kerberos ticket reuse and lateral movement detection. |
| Recommendation — Correlate ticket reuse with host compromise and unusual lateral access patterns. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Supports correlating authentication and host telemetry to spot anomalous ticket use. |
| IA-5 — Authenticator Management | Applies to credential and ticket lifecycle controls that limit reuse and exposure. | |
| Recommendation — Review authentication and endpoint logs for anomalous Kerberos ticket activity. Tighten authenticator lifecycle controls so cached credentials expire and rotate promptly. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Relevant because detection depends on collecting and correlating log evidence across hosts and auth systems. |
| CIS-6 — Access Control Management | Relevant to limiting where cached credentials can be used and reducing lateral movement paths. | |
| Recommendation — Centralise and correlate endpoint and authentication logs for ticket abuse signals. Restrict privileged access paths so cached tickets cannot enable broad lateral movement. | ||
Practitioner Guidance
What to verify: Confirm that your detections correlate host compromise signals with authentication logs, not just ticket events. If you only alert on Kerberos activity in isolation, you will miss the context that makes Pass the Cache visible.
What to prioritise: Start with high-value endpoints, admin workstations, and hosts that recently showed credential theft indicators. Those are the places where cached credential abuse is most likely to become material quickly.
What good looks like: You can explain why a ticket use is normal or abnormal for the account, host, and service path, and you can do so from evidence rather than from a generic “Kerberos happened” alert.
Practitioner takeaway: The best detections do not chase ticket use alone, they prove that the ticket use is inconsistent with the expected host, account, and session history.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org