Pass the Ticket

Expanded Definition

Pass the Ticket is a Kerberos abuse technique, not a separate authentication protocol. An attacker who obtains a valid ticket can present it to a service and inherit the privileges encoded in that ticket, bypassing the need to know the original password or secret. In NHI environments, this matters because service accounts, automated workloads, and legacy integrations often rely on Kerberos for trusted access paths.

The concept is often discussed alongside credential theft, lateral movement, and impersonation, but it is distinct because the ticket itself becomes the bearer credential. Standards guidance around access control and identity assurance, such as the NIST Cybersecurity Framework 2.0, helps frame the operational impact, while Kerberos ticket handling remains implementation specific. Definitions vary across vendors when they describe the detection surface, because some focus on ticket theft and others on post-theft use. The most common misapplication is treating Pass the Ticket as a password-reset issue, which occurs when teams miss that the attacker is reusing an already issued artifact rather than cracking an account.

Examples and Use Cases

Implementing detection and containment rigorously often introduces telemetry, coordination, and response overhead, requiring organisations to weigh faster incident interruption against additional logging and operational complexity.

• An adversary extracts a Kerberos ticket from a compromised endpoint and reuses it to reach file shares or internal applications without triggering a fresh login prompt.
• A privileged service account ticket is stolen from memory or a cache, then replayed laterally to access systems that trust that service identity.
• An incident response team traces unusual access back to a ticket issued before the compromise, using lifecycle and privilege context from the Ultimate Guide to NHIs to understand where the identity should have been constrained.
• Security engineers align ticket handling with identity hardening guidance from the NIST Cybersecurity Framework 2.0 by limiting exposure, improving monitoring, and reducing privilege scope.
• A red team demonstrates that a ticket with broad authorization can move across multiple internal services until expiry, showing how reused Kerberos artifacts amplify access.

In practice, the attack is most dangerous where long-lived sessions, weak workstation protection, and broad service entitlements overlap.

Why It Matters in NHI Security

Pass the Ticket is a warning sign that identity trust has already been converted into reusable access. For NHI security teams, the issue is not only stolen credentials but also the hidden privilege carried inside the ticket, which can outlive the compromise point and spread laterally across systems. This is why Kerberos ticket hygiene belongs in the same governance conversation as secret rotation, service account control, and Zero Trust enforcement. NHIMG research shows that 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, which makes ticket reuse especially damaging when service identities are over-permissioned. The Ultimate Guide to NHIs also notes that only 5.7% of organisations have full visibility into their service accounts, a visibility gap that complicates detection and containment. Where identity assurance is weak, ticket abuse can become the mechanism that turns one compromise into an enterprise-wide incident. Organisations typically encounter the business impact only after unusual lateral movement or data access has already occurred, at which point Pass the Ticket becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• How should teams respond when a secret is found in a support ticket?
• How should identity teams move from ticket queues to product ownership?
• When does ticket-based access management become too slow for NHI governance?
• When should organisations rotate a secret found in a support ticket?