About

Imported from mukul975/anthropic-cybersecurity-skills (skills/detecting-pass-the-ticket-attacks/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill detecting-pass-the-ticket-attacks. Copyright stays with the author (Apache-2.0).

Detecting Pass-the-Ticket Attacks

Name: detecting-pass-the-ticket-attacks
Author: mukul975

Overview

Pass-the-Ticket (PtT) is a credential theft technique (MITRE ATT&CK T1550.003) where adversaries steal Kerberos tickets (TGT or TGS) from one system and replay them on another to authenticate without knowing the user's password. This skill teaches detection of PtT attacks by correlating Windows Security Event IDs 4768 (TGT request), 4769 (TGS request), and 4771 (pre-authentication failure) for anomalies such as ticket reuse across different hosts, RC4 encryption downgrades, and unusual service ticket request volumes.

When to Use

When investigating security incidents that require detecting pass the ticket attacks
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Windows Domain Controller with advanced audit policy enabled (Audit Kerberos Authentication Service, Audit Kerberos Service Ticket Operations)
Splunk or Elastic SIEM ingesting Windows Security event logs
Sysmon deployed on endpoints for supplementary process telemetry
Python 3.8+ with requests library

Steps

Enable Kerberos audit logging on Domain Controllers via Group Policy
Forward Event IDs 4768, 4769, and 4771 to SIEM platform
Deploy detection rules for RC4 encryption downgrade (TicketEncryptionType 0x17)
Create correlation rule for ticket reuse across multiple source IPs
Build baseline of normal TGS request volume per user/host
Alert on standard deviation anomalies in ticket request patterns
Investigate flagged events with enrichment from Active Directory

Expected Output

JSON report containing detected PtT indicators including anomalous ticket requests, RC4 downgrades, cross-host ticket reuse events, and risk-scored users with MITRE ATT&CK technique mapping.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-detecting-pass-t-517565/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-detecting-pass-t-517565.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-detecting-pass-t-517565",
  "kind": "skill",
  "name": "detecting-pass-the-ticket-attacks",
  "description": "Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM. Use when investigating incidents involving stolen or replayed Kerberos tickets, building detection rules or threat hunting queries for ticket abuse, or validating SOC monitoring coverage for credential-theft attack techniques.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "customer_support"
    ],
    "tags": [
      "skill-md",
      "kerberos",
      "pass-the-ticket",
      "active-directory",
      "splunk",
      "elastic",
      "credential-theft",
      "windows-security",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM. Use when investigating incidents involving stolen or replayed Kerberos tickets, building detection rules or threat hunting queries for ticket abuse, or validating SOC monitoring coverage for credential-theft attack techniques."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/detecting-pass-the-ticket-attacks/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/detecting-pass-the-ticket-attacks/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/detecting-pass-the-ticket-attacks/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Detecting Pass-the-Ticket Attacks\n\n## Overview\n\nPass-the-Ticket (PtT) is a credential theft technique (MITRE ATT&CK T1550.003) where adversaries steal Kerberos tickets (TGT or TGS) from one system and replay them on another to authenticate without knowing the user's password. This skill teaches detection of PtT attacks by correlating Windows Security Event IDs 4768 (TGT request), 4769 (TGS request), and 4771 (pre-authentication failure) for anomalies such as ticket reuse across different hosts, RC4 encryption downgrades, and unusual service ticket request volumes.\n\n\n## When to Use\n\n- When in",
  "cost": {
    "context_tokens": 483
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-detecting-pass-t-517565/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.