From asi
Detects Kerberos Golden Ticket forgery via Windows Event ID 4769 analysis in Splunk/Elastic SIEM for RC4 encryption downgrades, abnormal lifetimes, and krbtgt anomalies. For threat hunting and SOC detection rules.
npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
A Golden Ticket attack (MITRE ATT&CK T1558.001) involves forging a Kerberos Ticket Granting Ticket (TGT) using the krbtgt account NTLM hash, granting unrestricted access to any service in the Active Directory domain. This skill detects Golden Ticket usage by analyzing Event ID 4769 for RC4 encryption type (0x17) in environments enforcing AES, identifying tickets with abnormal lifetimes exceedin...
Detects Kerberos Golden Ticket forgery in Windows Event ID 4769 via Splunk/Elastic SIEM, identifying RC4 downgrades, abnormal lifetimes, orphaned TGS, and krbtgt anomalies.
Detects Golden Ticket attacks in Active Directory Kerberos logs by analyzing TGT anomalies like mismatched encryption types, impossible lifetimes, non-existent accounts, and forged PAC signatures. Useful for threat hunting in domain controller event logs.
Detects Kerberos golden ticket forgery by analyzing Windows Event ID 4769 in Splunk and Elastic SIEM for RC4 (0x17) downgrades, anomalous ticket lifecycles, and krbtgt account anomalies.
Share bugs, ideas, or general feedback.
A Golden Ticket attack (MITRE ATT&CK T1558.001) involves forging a Kerberos Ticket Granting Ticket (TGT) using the krbtgt account NTLM hash, granting unrestricted access to any service in the Active Directory domain. This skill detects Golden Ticket usage by analyzing Event ID 4769 for RC4 encryption type (0x17) in environments enforcing AES, identifying tickets with abnormal lifetimes exceeding domain policy, correlating TGS requests with missing corresponding TGT requests (Event ID 4768), and detecting krbtgt password age anomalies.
JSON report with Golden Ticket indicators including RC4 downgrades, orphaned TGS requests, abnormal ticket lifetimes, and risk-scored alerts with MITRE ATT&CK technique mapping.