Full Report
Clear up common misconceptions about the Kerberos Diamond Ticket and learn how to refine the technique for better OPSEC, including more realistic PAC details and support for service tickets. You’ll learn how to apply the idea securely to both Ticket Granting Tickets and Service Tickets, creating forgeries that blend in more effectively with legitimate Kerberos traffic. The result is a stealthier alternative to traditional Silver Tickets and a more convincing method that raises the bar for Kerberos forgeries.
Analysis Summary
# Tool/Technique: Kerberos Diamond Ticket (Refined)
## Overview
A Diamond Ticket is a sophisticated Kerberos forgery technique where an attacker requests a legitimate Ticket Granting Ticket (TGT) from a Domain Controller (DC) and then decrypts, modifies, and re-encrypts it using the `krbtgt` account’s AES256 key.
The purpose of this technique is to blend in with legitimate Kerberos traffic by ensuring a valid `AS-REQ` / `AS-REP` exchange occurs, unlike "Golden Tickets" which are created entirely offline and appear in the environment without a preceding request. The "refined" version focuses on improving Operational Security (OPSEC) by mimicking realistic Privilege Attribute Certificate (PAC) details and extending the technique to Service Tickets (STs).
## Technical Details
- **Type:** Technique (Credential Manipulation / Ticket Forgery)
- **Platform:** Windows Active Directory environments
- **Capabilities:**
- Manipulation of PAC (Privilege Attribute Certificate) group memberships.
- Modification of ticket identity (e.g., requesting a ticket for one user and altering it to another).
- Support for both Ticket Granting Tickets (TGTs) and Service Tickets (STs).
- Preserves legitimate ticket structure to bypass basic anomaly detection.
- **First Seen:** Concept popularized circa 2021/2022 (TrustedSec); Refined techniques discussed June 2025.
## MITRE ATT&CK Mapping
- **TA0006 - Credential Access**
- **T1558 - Steal or Forge Kerberos Tickets**
- **T1558.001 - Golden Ticket**
- **T1558.002 - Silver Ticket**
- **TA0004 - Privilege Escalation**
- **T1558 - Steal or Forge Kerberos Tickets**
## Functionality
### Core Capabilities
- **Legitimate Origin:** Unlike Golden Tickets, the Diamond Ticket begins with a standard `AS-REQ`, providing a legitimate network trail on the Domain Controller.
- **PAC Modification:** Attackers decrypt the returned TGT, inject high-privilege RIDs (Relative Identifiers) into the PAC, and re-sign it.
- **Service Ticket Forgery:** The refined technique allows for "Diamond Service Tickets," providing a stealthier alternative to Silver Tickets by involving a legitimate TGS exchange.
### Advanced Features
- **OPSEC Refinement:** Moving beyond default Rubeus values (520, 512, 513, 519, 518) to include realistic logon sessions and device attributes.
- **Encryption Downgrade Protection:** Modern implementations focus on maintaining AES256 encryption to avoid the "encryption downgrade" alerts common with older Kerberos attacks.
## Indicators of Compromise
- **File Hashes:** N/A (Technique-based, though tool specific hashes for Rubeus/Mimikatz apply).
- **Behavioral Indicators:**
- **Event ID 4768 (TGT Request):** Look for requests where the user requested does not match the user in the resulting service access.
- **PAC Mismatches:** Discrepancies between the group memberships in the PAC and those recorded in Active Directory for the specific user.
- **Anomalous Ticket Lifetimes:** Tickets that deviate from the default domain policy (e.g., 10 hours).
## Associated Threat Actors
- While specific groups are not named in the provided text, Kerberos forgery is a staple of **Advanced Persistent Threats (APTs)** and **Ransomware Operators** (e.g., FIN7, Wizard Spider) once they have obtained Domain Admin-level keys.
## Detection Methods
- **Behavioral Detection:** Monitoring for `AS-REQ` followed by immediate high-privileged activity from a standard user account.
- **PAC Validation:** Environments enforcing strict PAC validation or using the "Protected Users" group can flag unauthorized modifications.
- **Tool-Specific Signatures:** Detecting Rubeus’s default RID sequences (512, 513, 518, 519, 520) within encrypted blobs if decryption for inspection is available.
## Mitigation Strategies
- **KRBTGT Password Rotation:** Regularly rotate the `krbtgt` account password (twice) to invalidate existing forged tickets.
- **Tiered Administration:** Use Tier 0/1/2 models to prevent Domain Admin credentials from being exposed on compromised workstations.
- **Protected Users Group:** Place sensitive accounts into this group to restrict delegation and force stronger encryption types.
## Related Tools/Techniques
- **Rubeus:** The primary tool used for Diamond Ticket implementation.
- **Golden Ticket:** Forging a TGT from scratch (less stealthy).
- **Silver Ticket:** Forging a Service Ticket from scratch.
- **Mimikatz:** Often used for credential harvesting to facilitate these attacks.