Most Popular Detection 2026: Golden/Silver Ticket - RC4-Downgraded or Orphan TGS Kerberos Tickets
This rule identifies suspicious Kerberos activity indicative of Golden or Silver Ticket attacks. It monitors for service ticket (4769) requests that occur without a preceding TGT request (4768) within a specified window, detects RC4 encryption downgrades on Kerberos requests in environments expected to use AES, and identifies tickets containing non-standard TicketOptions commonly associated with automated forgery tools like Mimikatz.
Microsoft Sentinel (KQL)
