Golden ticket

In Kerberos, every ticket-granting ticket (TGT) is encrypted with the key of the krbtgt account, and domain controllers trust any TGT they can decrypt. An attacker who steals that key can therefore forge their own TGTs: for any user, with any group memberships, valid for as long as they choose. That forged ticket is the golden ticket.

Getting the krbtgt key requires very high privileges first, usually domain administrator rights, for example by copying the Active Directory database from a domain controller or abusing replication rights (DCSync). That is why a golden ticket is a sign of deep compromise and a way for attackers to keep access even after passwords are reset.

Example

After compromising a domain administrator, an attacker extracts the krbtgt hash and leaves. Months later, the organization resets every user's password, but the attacker returns with a forged TGT claiming to be a domain administrator, and the domain controllers accept it because the krbtgt key never changed.

Why it matters for a SOC analyst

Golden tickets are hard to detect directly; anomalies such as tickets with unusual lifetimes, or service ticket requests without a matching TGT request (event 4769 without a prior 4768 from that account) can hint at them. Remediation is specific: after a domain compromise, the krbtgt password must be reset twice, with enough time between the resets for replication, so that old forged tickets stop working.