Silver Ticket Attack

A Silver Ticket attack is a technique used by an attacker who has already gained a foothold in an Active Directory network. It involves forging a Kerberos service ticket (TGS — Ticket-Granting Service, the ticket issued for access to one specific service) and presenting it straight to that service, bypassing the domain controller. The ticket is encrypted with the password of the service account or computer account that owns the service, so the service treats it as genuine. The domain controller (KDC — Key Distribution Center, which normally issues Kerberos tickets) takes no part in this, so it leaves no trace in its logs. That is the main difference from a Golden Ticket attack: a Golden Ticket needs the krbtgt account password and grants control over the whole domain, while a Silver Ticket targets a single service — which makes it much harder to detect.

How does a Silver Ticket attack work?

The attack abuses the way Kerberos checks service tickets. Normally a client gets an initial ticket (TGT) from the domain controller, exchanges it for a service ticket (TGS), and then presents that ticket to the service. The ticket is encrypted with the service account’s long-term key (derived from its password), so the service can read it and trusts its contents. Inside the ticket sits the PAC (Privileged Attribute Certificate), which states who the user is and which groups they belong to (the SIDs — identifiers for accounts and groups).

If an attacker obtains the password hash of the service account (or computer account), they can build and encrypt a valid TGS themselves — with no contact to the domain controller. It usually goes like this:

1. Reconnaissance — the attacker gathers the Domain SID, the domain name, and the SPN (Service Principal Name) of the target service. An SPN is simply the name by which the service is known in the domain.
2. Obtain the service account hash — extract the password hash of the service or computer account. This can be done in several ways: through Kerberoasting (cracking the passwords of SPN-bound accounts offline, on the attacker’s own hardware), an LSASS memory dump, a DCSync attack, or from the SAM or NTDS.dit of a compromised machine.
3. Forge the ticket — generate a TGS with any PAC you like (for example, impersonating a domain administrator) and encrypt it with the service account hash. Tools such as Mimikatz or Impacket (ticketer.py) automate this step.
4. Present the ticket — hand the forged ticket straight to the service (e.g. CIFS, HTTP, MSSQL, HOST), which decrypts and accepts it.
5. Use the access — act as the service: read files, query databases, run code, or move deeper into the network.

How does a Silver Ticket differ from a Golden Ticket?

Both attacks forge Kerberos tickets, but they differ in the key, the reach, and how easy they are to spot:

• Key / hash — a Golden Ticket forges the initial ticket (TGT) with the krbtgt account hash; a Silver Ticket forges a service ticket (TGS) with the hash of a specific service or computer account.
• Reach — a Golden Ticket opens access to any service across the whole domain (effectively taking over the domain); a Silver Ticket is limited to a single service on a single machine.
• Domain controller involvement — a Golden Ticket still exchanges the TGT for a TGS at the domain controller, so it leaves events there; a Silver Ticket bypasses the controller entirely, because the ticket is built locally.
• Detectability and persistence — to invalidate a Golden Ticket you have to change the krbtgt password twice; a Silver Ticket is often more durable in practice, because service and computer account passwords are changed less often, and the lack of any trace on the controller makes it harder to catch.

How do you detect a Silver Ticket attack?

Detection is hard because the ticket request never reaches the domain controller. So there are no 4768 (initial ticket request) or 4769 (service ticket request) events that would normally come before such access. Telemetry has to be collected on the machine running the service, looking for inconsistencies:

• A logon with no prior ticket request — a 4624 logon event via Kerberos on the service server, with no matching 4769 event on the domain controller.
• Odd ticket and PAC fields — mismatched or blank identity data, SIDs that match no real account, or a ticket lifetime that doesn’t fit domain policy.
• Weak encryption — tickets encrypted with RC4 (type 0x17, etype 23) where the environment enforces AES can be a sign of a forgery.
• Unusual service or computer account access — logons at odd hours, from unexpected machines, or to resources outside the service’s normal pattern of work.

For SOC, network-monitoring, and NDR teams the key point is this: the attack is “quiet” at the directory level and only becomes visible at the level of the service host and its access patterns. Effective detection means collecting logs from member servers too (not just domain controllers), establishing what normal behavior looks like for service accounts, and comparing Kerberos logons with the actual traffic to services.

How do you defend against a Silver Ticket attack?

The attack depends on obtaining a service account hash, so defense focuses on making credential theft harder, forcing tickets to be checked, and shortening the time a stolen key stays useful:

• gMSA / dMSA — group managed service accounts, which change long, random passwords on their own (every 30 days by default). This gets rid of static, weak service-account passwords.
• Strong passwords and regular rotation — including routine service-account password changes and computer-account password resets; long passwords frustrate Kerberoasting.
• Enforce AES — disable RC4 encryption for Kerberos tickets to make cracking harder and suspicious tickets easier to spot.
• Service-side PAC validation — turn on PAC verification so the service confirms a ticket’s validity with the domain controller instead of trusting it blindly.
• Least privilege — limit service-account rights, mark sensitive accounts as “cannot be delegated,” and keep them out of administrative groups.
• Incident response — on suspected compromise: identify which service account was hit, reset its password immediately, and analyze how far the attacker may have moved through the network.

Learn more

• Privileged Access Management (PAM) — PAM limits privileged accounts that Silver Ticket attacks can impersonate to access services.
• TTPs — Silver Ticket attack is a TTP used to forge service tickets and access Kerberos-protected services.
• Golden Ticket attack – detecting Kerberos attacks and securing Active Directory — Golden Ticket and Silver Ticket are related Kerberos forgery attacks, but Silver Ticket targets service tickets.
• APT (Advanced Persistent Threat) — APT actors may use Silver Ticket attacks to maintain stealthy access to specific services.
• Resource Hijacking — Silver Ticket abuse can help attackers hijack service resources without authenticating normally.
• Privilege Escalation — Silver Ticket attacks can elevate access by forging service tickets for higher-privilege accounts.
• Identity and Access Management (IAM) — IAM controls help reduce the impact of Silver Ticket attacks on service authentication.
• ARP Spoofing / Poisoning — ARP spoofing can aid lateral movement that may precede a Silver Ticket attack.