TGT Harvesting

How TGT Harvesting Works

Ticket Granting Tickets sit at the centre of Kerberos after a user has already proved who they are. When an attacker steals one, they are not breaking the protocol itself, they are stealing a ready-made proof of prior authentication that can be replayed to obtain fresh service tickets until the ticket expires or is invalidated.

This makes TGT harvesting a post-authentication abuse technique rather than a password guess or a normal login. The attacker’s value comes from persistence and reuse, because the stolen ticket can let them keep moving through Kerberos-enabled services without forcing a new interactive sign-in.

Why TGT Theft Is So Valuable to Attackers

A harvested TGT is attractive because it compresses access into a portable artifact. If the ticket is still valid, the attacker may be able to request additional service tickets quietly, which reduces friction, avoids obvious login prompts, and can blend into routine authentication traffic.

That is also why TGT harvesting often pairs with other identity abuse, such as session theft, credential dumping, or privilege escalation. Once a ticket is in memory or on disk, the attacker is no longer trying to guess a password, they are trying to preserve and reuse an already trusted authentication state.

Modern detection teams often treat this as a form of credential access and lateral movement. MITRE ATT&CK Enterprise is useful here because it maps how stolen credentials and tickets support post-compromise movement across an environment.

How Organisations Check Exposure to TGT Harvesting

Exposure usually starts with where Kerberos tickets are created, cached, and protected. Organisations need to know which endpoints, servers, and privileged workstations can hold tickets in memory, which accounts use Kerberos heavily, and where attackers would most likely try to extract ticket material after initial access.

Vendor guidance and platform hardening advice matter here because ticket theft is often enabled by weak endpoint protection, overly broad admin rights, or poor separation between privileged and standard user activity. NIST SP 800-53 Rev 5 Security and Privacy Controls is a useful reference point for combining access control, audit, and system integrity safeguards around this class of abuse.

NIST SP 800-63 Digital Identity Guidelines is also relevant when organisations want stronger authentication assurance upstream, because TGT harvesting becomes more damaging when initial authentication is weak or easily replayed.

For a broader control lens, NIST Cybersecurity Framework 2.0 helps structure visibility, protective controls, and response planning around identity-based compromise.

Remediation and Compensating Controls

If TGT harvesting is suspected, the immediate response is to treat the stolen ticket as a live access token until its validity is removed. That usually means revoking or expiring affected sessions where possible, resetting compromised credentials, and limiting the attacker’s ability to reuse the same access path from the infected host.

Compensating controls matter when a full patch or full clean-up cannot happen immediately. Network segmentation, privilege reduction, hardened admin endpoints, and tighter monitoring of ticket-related activity all reduce the value of the stolen TGT even before eradication is complete. NIST SP 800-207 Zero Trust Architecture supports that approach by pushing organisations toward continuous verification and reduced implicit trust.

Because TGT theft is often part of a broader credential-access chain, OWASP Non-Human Identity Top 10 is useful as an adjacent control lens when Kerberos tickets, service accounts, and other secret-bearing access paths need tighter governance.

Detection and Post-Compromise Review

Detection should look for unusual ticket use, suspicious service-ticket requests, or access patterns that do not fit the user’s normal logon behaviour. A stolen TGT may still look valid at first glance, so review work needs to focus on where the ticket was obtained, which hosts were involved, and whether the same access was replayed from unexpected systems.

Post-compromise review should extend beyond the ticket itself. If the attacker obtained a TGT from a privileged user, service account, or high-value workstation, assume follow-on access may already have occurred and review downstream services, logs, and administrative actions for signs of lateral movement or persistence.

Where Kerberos abuse sits inside a larger attack chain, Anthropic, first AI-orchestrated cyber espionage campaign report is a reminder that modern intrusion chains can include automated credential harvesting and reuse at scale, even when the core abuse mechanism is still conventional identity compromise.

Related resources from NHI Mgmt Group

• How can security teams reduce abuse from bulk profile harvesting?
• Why do AI agents create new risk for credential harvesting and intrusion workflows?
• How do security teams know if a package installer is crossing the boundary into identity harvesting?
• How should security teams defend npm supply chains against credential-harvesting worms that spread through compromised maintainer access?