1200KM / detection
T1558 Steal or Forge Kerberos Tickets — Detection Rules
Detection workspace for T1558 Steal or Forge Kerberos Tickets: 5 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Antivirus Password Dumper Detection · stable · critical · {"category":"antivirus"}
- Replay Attack Detected · test · high · {"service":"security","product":"windows"}
- HackTool - Mimikatz Kirbi File Creation · test · critical · {"category":"file_event","product":"windows"}
- Uncommon Outbound Kerberos Connection · test · medium · {"category":"network_connection","product":"windows"}
- Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock · experimental · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enable"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0522 Detect Kerberos Ticket Theft or Forgery (T1558)
AN1443 Analytic 1443
Detects anomalous Kerberos activity such as forged or stolen tickets by correlating malformed fields in logon events, RC4-encrypted TGTs, or TGS requests without corresponding TGT requests. Also detects suspicious processes accessing LSASS memory for ticket extraction.
AN1444 Analytic 1444
Detects suspicious access to SSSD secrets database and Kerberos key material indicating ticket theft or replay attempts. Correlates anomalous file access with unusual Kerberos service ticket requests.
AN1445 Analytic 1445
Detects attempts to forge or replay Kerberos tickets by monitoring Unified Logs for anomalous kinit/klist activity and correlating unusual authentication sequences.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
- Active Directory Credential Request · DC0084
- File Access · DC0055
- Logon Session Metadata · DC0088
- Process Access · DC0035
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.