A Silver Ticket is forged for one specific service, while a Golden Ticket is forged from the KRBTGT account and can grant domain-wide access. Silver Ticket abuse is narrower but can be stealthier because it may avoid KDC checks after creation. Golden Ticket abuse is broader, enabling impersonation, lateral movement, and persistence across the domain.
What makes a Silver Ticket narrower than a Golden Ticket?
A Silver Ticket is service-specific, so the attacker forges a ticket that only works against one target service and the key or secret for that service. A Golden Ticket is built from the domain’s KRBTGT secret, which gives the attacker far broader reach. The practical difference is scope, blast radius, and how much of Active Directory the forged ticket can influence.
That scope difference changes how defenders should think about the compromise. Silver Ticket abuse is often more constrained to a single service path, while Golden Ticket abuse is a domain trust problem that can outlive the initial intrusion if the KRBTGT secret is not addressed.
Why Silver Tickets can be stealthier, but Golden Tickets are more dangerous
Silver Tickets can be harder to spot because they are created offline and may not need repeated validation with the KDC after forging. That makes the attack attractive when an adversary already has enough material to impersonate access to one service without touching the normal Kerberos request flow.
Golden Tickets are more dangerous because they are not just a service impersonation trick, they are a domain-level persistence mechanism. Once an attacker can mint tickets from the KRBTGT secret, they can impersonate accounts across the domain, move laterally, and keep access even after some account-level resets.
For defenders, the operational distinction is important: one attack may show up as suspicious service access, while the other should be treated as domain compromise until proven otherwise. That is why Kerberos monitoring, ticket anomaly review, and krbtgt handling need to be separated in incident response.
What defenders should verify during investigation and recovery
Start by confirming whether the evidence points to a single-service forgery or a domain-wide ticket forgery. If the compromise is limited to one service, validate that service account exposure, password age, and access scope. If the KRBTGT secret may be involved, treat the event as an Active Directory incident and look for broader signs of persistence, lateral movement, and forged authentication.
The safest recovery path for a suspected Golden Ticket scenario is usually to krbtgt account rotation with the right timing and replication checks, because one reset is not enough to invalidate all forged tickets. For broader domain compromise handling, the Active Directory Domain Compromise Response Playbook is the better response reference, especially when trust relationships and Tier 0 systems may also be exposed.
For defenders who want a broader Kerberos hardening view, the Kerberos Security Guide is the most complete place to connect ticket-forgery mechanics with the controls that reduce them.
Risk and Threat Considerations
Both attacks abuse trusted Kerberos material, so the main risk is not just unauthorized access, but the defender’s reduced visibility once forged tickets are in use. Silver Tickets can bypass normal ticket-granting checks for a single service, while Golden Tickets can turn one stolen domain secret into long-lived, domain-wide impersonation.
Failure mechanism: An attacker steals or derives the secret needed to forge Kerberos tickets, then presents those tickets directly to the target service or domain environment without following the normal authentication path.
Impact: The result can be stealthy service abuse in the Silver Ticket case, or persistent domain compromise, lateral movement, and repeated unauthorized access in the Golden Ticket case.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1558 — Steal or Forge Kerberos Tickets | The question compares two Kerberos ticket-forgery techniques. |
| Recommendation — Map the observed behavior to T1558 sub-techniques and hunt for forged-ticket activity. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Kerberos ticket abuse depends on compromised or forgeable authenticators and secrets. |
| Recommendation — Rotate and protect authenticators that could be used to forge or replay Kerberos access. | ||
| CIS Controls v8 | CIS-5 — Account Management | Golden and Silver Tickets exploit stolen identity material and excessive access scope. |
| Recommendation — Tighten account and service access, then remove standing privilege that enables ticket abuse. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication, and Access Control | The attack difference is fundamentally about how forged Kerberos identity is accepted and used. |
| Recommendation — Enforce strong identity controls and limit the access that forged tickets can inherit. | ||
Practitioner Guidance
What to verify: Treat suspicious Kerberos activity as a scope question first. If only one service is affected, focus on that service account, its privileges, and evidence of ticket forgery; if multiple services or Tier 0 systems are affected, assume a krbtgt-related problem until disproven.
Decision rule: If the attacker could mint a Golden Ticket, prioritize krbtgt recovery and domain-wide containment before narrower account resets. If the evidence points only to a Silver Ticket, contain the compromised service, rotate the relevant secret, and still check for broader ticket abuse patterns.
Practitioner takeaway: The real difference is not just where the forged ticket works, it is how much trust the attacker can inherit from it. Silver Ticket incidents are often service-bounded; Golden Ticket incidents are identity-bounded domain compromises that demand a much wider recovery posture.
Related resources from NHI Mgmt Group
- Guide: Golden Ticket, Silver Ticket and DCSync Guide
- Golden Ticket Attack
- What is the difference between a normal Kerberos ticket issue and a Golden Ticket attack?
- Why do Silver Ticket attacks remain dangerous even though they are narrower than Golden Ticket attacks?
- What are the signs that a Golden Ticket attack may be underway in Active Directory?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org