Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Golden Tickets, Silver Tickets and Pass-the-Hash are different identity-abuse techniques. Golden Tickets forge Kerberos ticket-granting tickets (TGTs) using the domain’s KRBTGT secret, Silver Tickets forge service-specific Kerberos tickets (TGSs) using a service-account secret, and Pass-the-Hash reuses password-hash material, usually through an NTLM-capable authentication path.
The distinction determines where evidence appears. Golden Ticket investigations emphasize domain-controller Kerberos records and privileged activity; Silver Ticket investigations must include the destination service host because ticket creation can occur without the KDC; Pass-the-Hash investigations focus on successful logons, NTLM context, endpoint processes and source-to-account patterns.
What the three attacks have in common—and what they do not
All three techniques let an intruder authenticate as another identity, but they abuse different authentication artifacts and leave different traces. Treating them as interchangeable makes detection and response less reliable.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Technique | Authentication artifact abused | Protocol path | Typical reach | Most important visibility issue |
|---|---|---|---|---|
| Golden Ticket | Forged Kerberos ticket-granting ticket (TGT) made with KRBTGT-derived secret material | Kerberos | Potentially broad domain identity impersonation | The forged TGT may not have a matching, normal TGT request in domain-controller logs |
| Silver Ticket | Forged Kerberos service ticket (TGS) made with a target service account’s secret | Kerberos | A particular service, resource and hosting system | The ticket can be created without contacting the Key Distribution Center (KDC), so domain-controller-only monitoring can miss it |
| Pass-the-Hash (PtH) | Password-hash material used as authentication material instead of the cleartext password | Often NTLM-capable authentication | Accounts and systems reachable through the applicable authentication paths | NTLM has legitimate uses and is not, by itself, proof of PtH |
Pass-the-Hash should also be kept separate from Pass-the-Ticket. Pass-the-Ticket reuses captured Kerberos ticket material; PtH reuses password-hash material. The names describe different artifacts and require different evidence.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Kerberos terms you need before investigating tickets
Ticket-granting ticket (TGT)
A TGT is the Kerberos credential a user or computer presents when requesting access to services. It is issued by the domain’s Key Distribution Center and is then used to obtain service tickets. A Golden Ticket is a counterfeit TGT rather than a stolen, normally issued one.
Ticket-granting service ticket (TGS)
A TGS, commonly called a service ticket, authorizes access to a specific service on a specific host. A Silver Ticket is a counterfeit TGS tied to a target service account and its service principal, so its useful scope is narrower than a forged TGT.
Key Distribution Center (KDC)
The KDC, hosted by domain controllers in a Windows domain, issues Kerberos tickets and handles the normal request sequence. Whether the KDC must see an operation is a major detection difference: ordinary Kerberos issuance creates request evidence, while a forged Silver Ticket can be produced and presented without a KDC exchange.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
KRBTGT
KRBTGT is the built-in Active Directory account whose secret is used to protect Kerberos ticket-granting operations. Compromise of its secret gives an attacker the material needed to forge TGTs. Recovering from that condition is an Active Directory recovery task, not an ordinary user-password change.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Golden Ticket: forged TGT with potentially domain-wide consequences
A Golden Ticket is a forged Kerberos TGT created from KRBTGT-derived secret material. Because a TGT can be used to request service tickets for many resources, the resulting impersonation can have broad domain implications. The apparent user name, groups and privileges in a ticket are not sufficient to establish that the domain controller issued it legitimately.
What defenders may observe
- A TGT with an anomalous lifetime or validity period compared with domain policy and normal tickets.
- An encryption type that is unexpected for the environment, such as RC4 where policy and the local baseline do not normally permit or use it.
- Malformed or inconsistent fields in logon and logoff records.
- Service-ticket activity without the expected preceding TGT-request activity.
- Unexpected privileged logons or elevated access, especially when the account, workstation, time or resource does not fit its normal pattern.
- Endpoint telemetry showing processes accessing authentication-related memory or other activity associated with credential material.
Relevant Windows Security records include service-ticket activity such as event 4769 and logon-session context such as events 4672 and 4634. Sysmon process-access telemetry can add endpoint context. These records are analytic inputs, not a universal Golden Ticket signature. A long ticket, RC4 encryption or an elevated logon alone can have an administrative or compatibility explanation.
How to investigate a suspected Golden Ticket
- Confirm the domain baseline. Document normal ticket lifetimes, permitted encryption types, account-to-host patterns and expected administrative logons. Without that baseline, “unusual” is only an assumption.
- Build the ticket timeline. Compare the suspicious service-ticket event with preceding TGT-request activity, the account’s other logons, source hosts, requested services and process creation on the originating systems.
- Validate identity and privilege context. Check whether the account normally uses the source workstation, whether its groups and privileges match the observed access, and whether the same identity appears on unrelated systems.
- Correlate domain-controller and endpoint evidence. A suspicious Kerberos record becomes stronger when endpoint process, network and logon evidence shows a coherent intrusion path.
- Scope the KRBTGT exposure. If the secret may have been obtained, assume that any ticket derived from it could remain usable until the recovery sequence is completed.
Containment and recovery
MITRE recommends resetting the built-in KRBTGT account password twice to invalidate existing Golden Tickets derived from the old secret. The two resets must be treated as a coordinated Active Directory operation: plan the sequence, allow replication to complete, account for ticket lifetimes and validate authentication across domain controllers and dependent services. A single reset is not sufficient for this recovery objective. Also investigate the systems and administrative accounts that could have exposed the KRBTGT secret; changing KRBTGT without addressing the compromise path can leave the domain vulnerable again.
Recommended Free Tools
Silver Ticket: forged service ticket with narrower reach
A Silver Ticket is a forged Kerberos TGS made with the password hash or other secret material of a target service account. It is aimed at a particular service and the host that provides it—for example, one server-side service rather than every Kerberos service in the domain.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Why domain-controller logs can be incomplete
The KDC normally issues service tickets, but an attacker who can forge a Silver Ticket can present it directly to the target service. MITRE states: “Adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.” MITRE ATT&CK’s Silver Ticket technique page documents this limitation.
As a result, the absence of a corresponding KDC request is not merely a suspicious signal; it can be an expected consequence of the technique. A domain-controller search alone may show little or nothing about ticket creation or use.
Where to look for Silver Ticket evidence
- Destination service host: collect service-side logons, authentication records and resource-access events on the computer hosting the targeted service.
- Service-account behavior: compare the identity, source host, client process and accessed resource with the account’s documented purpose.
- Kerberos characteristics: investigate unusual service-ticket activity, malformed logon data or encryption choices that conflict with the local baseline.
- Endpoint and network context: correlate the client process, source address, lateral movement and any credential-access activity with the service access.
Investigating a suspected Silver Ticket
- Start at the resource. Identify exactly which service, host and account accepted the suspicious authentication. The service boundary defines the initial scope.
- Compare expected use. Establish which systems normally use the service account, from which hosts, at what times and for which resources. Service accounts that suddenly appear from an administrator workstation or an unrelated server deserve scrutiny.
- Check KDC evidence, but do not depend on it. Look for a normal service-ticket request and compare its time, client and service values. Missing issuance evidence can support the hypothesis, but it cannot prove forgery by itself.
- Review the service host. Examine local logons, process launches, resource access and account changes around the event. The destination may contain the strongest evidence because it accepted the ticket.
- Rotate and contain the service secret. If the service-account secret is compromised, coordinate a password change or managed rotation with the service owner, update dependencies and investigate other hosts where that account is valid.
Pass-the-Hash: password-hash reuse over NTLM-capable paths
Pass-the-Hash uses a password hash as authentication material without requiring the attacker to know the cleartext password. It is commonly associated with NTLM-capable authentication and can support access to remote systems where that account and protocol are accepted.
Why NTLM evidence is a lead, not a verdict
NTLM remains present for legitimate compatibility and application reasons. Microsoft Defender for Identity associates suspicious NTLM behavior with Pass-the-Hash, but also with reconnaissance, brute-force activity and remote code execution. Therefore, a suspicious NTLM alert is an investigation lead rather than a unique PtH fingerprint.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Event 4624 and the context that matters
Microsoft Security event 4624 records a successful logon. Collect it on the accessed computer and examine the fields that identify the account, logon type, source network address, authentication package and process context. A successful NTLM logon is more informative when its source, identity, timing and process do not match the organization’s expected account-to-host pattern.
- Was NTLM used where Kerberos or another approved method is expected?
- Does the source address belong to the account’s normal workstation or administration tier?
- Is the logon type consistent with the service or remote-management action?
- Did the same account authenticate successfully to multiple hosts in a short period?
- Do endpoint and network records show remote execution, credential access or discovery around the logon?
Auditing and reducing NTLM
Microsoft’s NTLM auditing policy records NTLM traffic in the Microsoft-Windows-NTLM operational log. Begin with auditing to discover applications, servers and workflows that still depend on NTLM. Then evaluate restriction or blocking controls appropriate to the Windows versions in the deployed fleet. Auditing alone records traffic; it does not mitigate Pass-the-Hash. Policy names and supported controls vary by Windows release, so validate the settings against the systems you actually operate.
Response to suspected Pass-the-Hash
- Isolate or restrict the source endpoint when the surrounding evidence indicates active lateral movement.
- Identify every account and host involved in the suspicious NTLM sequence.
- Reset exposed account credentials and remove unnecessary local-administrator or service-account access.
- Review endpoint process and network telemetry for remote execution, reconnaissance and credential-access activity.
- Use NTLM auditing results to prioritize application remediation before enforcing broader restrictions.
Detection differences at a glance
| Detection question | Golden Ticket | Silver Ticket | Pass-the-Hash |
|---|---|---|---|
| What artifact should you validate? | Kerberos TGT | Kerberos service ticket (TGS) | Password-hash authentication material |
| Must the KDC see creation or issuance? | Normal TGT issuance may be absent or inconsistent with the forged ticket | No; a forged TGS can be created without KDC interaction | Not applicable to ticket issuance; investigate the NTLM authentication path |
| Where should collection begin? | Domain controllers, then privileged destination hosts and endpoints | Destination service host, service logs and client endpoint, with DC data as supporting context | Accessed computer’s 4624 records, NTLM operational logs, endpoint and network telemetry |
| What scope is suggested? | Potentially broad domain impersonation | Specific service, resource and host | Any account and system reachable through the reused hash and accepted protocol |
| High-value suspicious signals | Anomalous lifetime or encryption, missing request sequence, malformed fields, unexpected privileged access | Service-account use outside its normal hosts or resources, malformed data, unusual service access without expected KDC activity | Unexpected NTLM, unusual source/account pairing, abnormal logon type or process context, rapid multi-host access |
No single row in this table proves compromise. Detection confidence rises when identity, host, encryption, service, process and network evidence agree with one another and conflict with the local baseline.
A practical, correlated investigation workflow
1. Preserve the right telemetry
Forward domain-controller Kerberos and Windows Security events, destination-service authentication and resource-access logs, endpoint process telemetry, network records and the Microsoft-Windows-NTLM operational log where NTLM auditing is enabled. Silver Ticket investigations fail when collection stops at the domain controller; PtH investigations fail when 4624 is collected without source and process context.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
2. Classify the artifact before choosing a hypothesis
Ask whether the evidence describes a TGT, a service-specific TGS or an NTLM authentication. A suspicious Kerberos ticket should not automatically be labeled Golden Ticket, and an NTLM logon should not automatically be labeled PtH. The artifact determines which systems and event sequences are relevant.
3. Compare with normal behavior
Build baselines for ticket lifetime, encryption type, service-account hosts, administrative source addresses, normal logon types and approved NTLM dependencies. Encryption such as RC4 is meaningful only when it is unexpected under the domain’s configuration and observed baseline; RC4 alone is not proof of attack.
4. Correlate identity, host and time
Join the account, source address, destination host, service, process and timestamp across records. Look for impossible or unexplained combinations: a service account from an unrelated client, a privileged logon with no expected administrative activity, a service ticket without a normal request trail, or NTLM use from a newly compromised endpoint.
5. Escalate only when the combined evidence supports it
Use suspicious or anomalous language for individual signals. Escalate to an incident response investigation when multiple independent records support the same attack path, then contain the relevant secret or protocol rather than applying a generic “Kerberos incident” response.
Common analytical mistakes
- Calling every forged ticket a Golden Ticket: first determine whether the artifact is a domain TGT or a service-specific TGS.
- Assuming no domain-controller event means no Silver Ticket: direct service-ticket forgery can bypass the KDC.
- Treating all RC4 usage as malicious: compare it with current policy, compatibility requirements and local history.
- Calling every NTLM logon Pass-the-Hash: validate source, account, logon type, process and surrounding behavior.
- Confusing PtH with Pass-the-Ticket: the former reuses password-hash material; the latter reuses Kerberos ticket material.
- Resetting only one secret or one account: Golden Ticket recovery requires the coordinated two-reset KRBTGT procedure, while Silver Ticket and PtH cases require rotation of the specific compromised service or user credentials and investigation of affected hosts.
- Relying on a single event ID: event 4769, 4672, 4634 or 4624 is evidence to correlate, not a standalone attack label.
Choosing the right response path
| If the strongest evidence points to… | Prioritize | Do not rely on |
|---|---|---|
| Golden Ticket | Domain-wide scoping, privileged-logon review, endpoint investigation and coordinated double KRBTGT reset with replication validation | One ticket anomaly or a single KRBTGT password reset |
| Silver Ticket | Destination service-host logs, service-account secret rotation, resource scoping and investigation of other valid hosts | Domain-controller logs alone |
| Pass-the-Hash | 4624 context, NTLM operational auditing, endpoint isolation where warranted, credential hygiene and reduction of unnecessary NTLM dependencies | NTLM presence alone or an audit policy without remediation |
The practical dividing line is the authentication material and the place where it must be validated. Golden Ticket investigations ask whether a domain-level TGT is legitimate and whether KRBTGT recovery is required. Silver Ticket investigations ask which service accepted a ticket that may never have passed through the KDC. Pass-the-Hash investigations ask whether password-hash authentication through NTLM fits the account, host and process context. Keeping those questions separate produces more useful alerts and more targeted containment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
