iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Golden Ticket and Silver Ticket attacks forge Kerberos tickets; Pass the Hash reuses an NTLM password hash or a related credential to authenticate. The distinction matters: the attacks use different credential material, reach different parts of an Active Directory environment, and leave different evidence for defenders to investigate.
This guide focuses on Windows enterprise networks and Active Directory. It explains what each technique does, how their scope and visibility differ, and which defensive controls and detection signals are relevant.
How the three attacks differ
| Technique | Credential material and action | Typical scope | Visibility implication |
|---|---|---|---|
| Golden Ticket | The KRBTGT account hash is used to forge a Kerberos ticket-granting ticket (TGT). | Potentially broad access across the Active Directory domain, depending on the ticket’s claims and the resources’ authorization rules. | Investigate ticket anomalies, unexpected accounts, encryption downgrades, and authentication chains that lack expected events. |
| Silver Ticket | A target service account’s hash is used to forge a Kerberos service ticket (TGS). | The service or resource associated with that account, typically on its host. | The ticket may be created without contacting the key distribution center (KDC), so KDC logs alone may not show the full activity. |
| Pass the Hash | An NTLM password hash or another credential derivative is reused to authenticate to a remote server or service. | Depends on the account’s permissions and which systems accept the authentication. | Unusual NTLM network logons need to be correlated with the source host, process, user session, and network activity. |
A TGT is used to request access to services; a TGS is for access to a particular service. A forged ticket is therefore not the same thing as reusing a password hash. Overpass-the-hash is a related but distinct technique: it uses hash material to obtain a Kerberos ticket, combining hash use with ticket creation.
Golden Ticket: forged ticket-granting tickets
A Golden Ticket attack becomes possible when an attacker obtains the KRBTGT account hash, which is associated with the domain’s Kerberos ticket-granting service. With that material, the attacker can forge TGTs for Active Directory accounts. The potential reach is broad, but it is not automatically unlimited: ticket claims, domain configuration, and each resource’s authorization still affect access.
#1 Best Overall
Defenders should look for unusual ticket properties and account or authentication patterns that do not fit the environment’s baseline. MITRE ATT&CK also identifies encryption downgrades and authentication chains missing expected activity as useful areas to investigate. No single anomaly proves a Golden Ticket attack.
Microsoft Defender for Identity documents alerts for suspected Golden Ticket use, including ticket anomalies and encryption downgrade. Microsoft specifies a five-day learning period for the encryption-downgrade alert; that describes how the alert behaves, not an attack frequency or guarantee of detection.
Silver Ticket: forged service tickets
A Silver Ticket uses a target service account’s hash to forge a TGS for the service associated with that account. Its typical scope is narrower than a Golden Ticket’s: it concerns a particular service or resource and its host, rather than potentially broad domain access.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteA key detection complication is that a forged service ticket may be created without contacting the KDC. A missing KDC request is therefore a signal to assess in context, not proof on its own. Investigators should also examine service-side activity, the host involved, account-to-resource relationships, ticket fields, endpoint processes, and possible access to LSASS (the Windows process that can hold sensitive authentication material).
Pass the Hash: authenticating with hash material
Pass the Hash (PtH) reuses an NTLM password hash or a credential derivative to authenticate to a remote server or service. Unlike Golden and Silver Ticket attacks, PtH is not inherently a Kerberos-ticket forgery technique. Its reach depends on the reused account’s rights and the systems that accept its authentication.
MITRE’s detection guidance highlights unusual NTLM network logons, including Logon Type 3, and recommends correlating them with session events 4624 and 4648, source and destination context, and process or network activity. Those event IDs are investigation clues, not standalone indicators: legitimate remote administration can also generate authentication and logon events.
How defenders can investigate the signals
Build a timeline across identity, endpoint, and network evidence instead of treating an individual event as conclusive. Compare activity with expected users, hosts, services, and administrative workflows.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Evidence area | What to correlate | Why it helps |
|---|---|---|
| Authentication and tickets | NTLM Logon Type 3 activity; events 4624 and 4648; Kerberos request events 4768 and 4769. | Unusual sequences, accounts, or ticket behavior can be assessed against normal authentication paths. |
| Endpoint activity | Process and network activity, process access, module loading, and possible LSASS access. | Host context can help distinguish suspicious credential use or ticket activity from a routine logon. |
| Service and KDC context | Whether service-ticket activity has corresponding KDC validation, and whether the account normally uses the resource. | Especially relevant to Silver Tickets, which may not produce the expected KDC interaction. |
MITRE’s detection strategies DET0409 (Pass the Hash), DET0352 (Pass the Ticket), and DET0241 (Silver Ticket) are version 1.0 and were last modified May 12, 2026. Their analytics describe signals to correlate, not a universal detection rule. Tune alert windows and expected account-host-service relationships to the local environment. MITRE’s Pass-the-Ticket strategy is relevant to ticket-based investigations, but Pass the Ticket is distinct from the three techniques compared here.
Best Value
Controls that reduce exposure
Protect credential material and limit reuse
Microsoft describes Credential Guard as using virtualization-based security (VBS) to isolate NTLM hashes and Kerberos TGTs. Microsoft’s overview says it protects those credentials and domain credentials stored by applications. Credential Guard has hardware, software, licensing, and configuration requirements, so verify that the specific Windows devices and deployment meet them. It is one layer of defense, not protection against every persistence or identity attack.
Reduce credential overlap between systems and restrict administrator credentials to the systems where they are needed. Microsoft’s Protected Users group and authentication policies can affect NTLM, credential caching, delegation, and compatibility. Check domain and Windows requirements and test the effect on applications and operational workflows before rollout.
Harden service accounts
For Silver Ticket risk, MITRE recommends strong service-account passwords that are changed periodically, least privilege, and AES or stronger Kerberos encryption where possible. Managed service accounts or password vaulting can help with password management. Review which services use each account and what resources that identity can access.
Responding to suspected Golden Ticket compromise
MITRE’s containment guidance is to reset the built-in KRBTGT password twice in each affected domain, allowing replication to complete between resets. This is a domain-wide operation: coordinate it with incident response and domain operations so that replication and authentication behavior are accounted for. The two-reset instruction is not a complete recovery runbook; the response also needs to address the compromise and investigate affected accounts, hosts, and services.
For all three techniques, detection is strongest when authentication, ticket requests, logons, endpoint processes, and host context are considered together. A suspicious signal should prompt investigation against the environment’s baseline rather than an automatic conclusion.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
