Golden Ticket Indicators: RC4 Downgrade & Orphaned TGS Requests

Ibrahim Saud@tektrix

•updated 16 days ago•0•0•0

Detects anomalous Kerberos ticket requests characteristic of Golden Ticket attacks. These forged tickets are created offline using the KRBTGT account hash, bypassing legitimate KDC TGT issuance, and frequently exhibit default Mimikatz artifacts such as RC4 encryption or extended ticket lifetimes.