npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
Pass-the-Ticket (PtT) is a credential theft technique (MITRE ATT&CK T1550.003) where adversaries steal Kerberos tickets (TGT or TGS) from one system and replay them on another to authenticate without knowing the user's password. This skill teaches detection of PtT attacks by correlating Windows Security Event IDs 4768 (TGT request), 4769 (TGS request), and 4771 (pre-authentication failure) for ...
Detects Kerberos Pass-the-Ticket attacks by analyzing Windows Event IDs 4768, 4769, 4771 in Splunk/Elastic SIEM for ticket reuse, RC4 downgrades, and volume anomalies. For threat hunting and SOC monitoring.
Detects Kerberos Golden Ticket forgery via Windows Event ID 4769 analysis in Splunk/Elastic SIEM for RC4 encryption downgrades, abnormal lifetimes, and krbtgt anomalies. For threat hunting and SOC detection rules.
Detects Kerberos Pass-the-Ticket attacks in Splunk/Elastic SIEM by analyzing Windows event IDs 4768/4769/4771 for anomalies like cross-host ticket reuse, RC4 downgrades, and unusual request volumes.
Share bugs, ideas, or general feedback.
Pass-the-Ticket (PtT) is a credential theft technique (MITRE ATT&CK T1550.003) where adversaries steal Kerberos tickets (TGT or TGS) from one system and replay them on another to authenticate without knowing the user's password. This skill teaches detection of PtT attacks by correlating Windows Security Event IDs 4768 (TGT request), 4769 (TGS request), and 4771 (pre-authentication failure) for anomalies such as ticket reuse across different hosts, RC4 encryption downgrades, and unusual service ticket request volumes.
requests libraryJSON report containing detected PtT indicators including anomalous ticket requests, RC4 downgrades, cross-host ticket reuse events, and risk-scored users with MITRE ATT&CK technique mapping.