Steal or Forge Kerberos Tickets T1558
Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic…
- Tactics
- Credential Access
- Actors using it
- 6
- Sub-techniques
- 3
Ransomware groups reported using it
Threat actors
- FIN7GOLD NIAGARA, ITG14, Carbon Spider · 50 techniques
- Wizard SpiderRussia · UNC1878, TEMP.MixMaster, Grim Spider · 49 techniques
- NIMBUS MANTICOREUNC1549, TA455, COBALT SMOKEY · 45 techniques
- Ke3changChina · APT15, Mirage, Vixen Panda · 37 techniques
- Indrik SpiderRussia · Evil Corp, Manatee Tempest, DEV-0243 · 27 techniques
- AkiraGOLD SAHARA, PUNK SPIDER, Howling Scorpius · 17 techniques