thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Pass-the-Ticket (PtT)

Using a stolen Kerberos ticket to authenticate to services without knowing the user's password.

Definition

Attackers extract TGTs or service tickets from memory and inject them into their own session to impersonate the user. Golden and silver tickets are forged variants. Monitoring for ticket anomalies, reducing privileged sessions on workstations and Credential Guard mitigate it.

Example

Exporting a domain admin's TGT with Rubeus and injecting it on another host.

Exam tip

PtT is Kerberos-based; PtH is NTLM-based.

Related terms