What is a Golden Ticket in Cyber Security?

A golden ticket in cyber security is a forged Kerberos authentication ticket that gives an attacker long-term, highly privileged access to systems in a Microsoft Active Directory environment. It is called “golden” because it can let the attacker impersonate almost any user, often including domain administrators.

Golden ticket attacks are associated with post-exploitation activity. The attacker usually needs to compromise the Active Directory Key Distribution Center secret, especially the KRBTGT account hash, before creating the forged ticket.

How a Golden Ticket Attack Works

Kerberos is an authentication protocol used by Active Directory to verify users and issue tickets for access to network resources. In a normal login, a user receives a ticket-granting ticket from the domain controller and uses it to request access to services.

In a golden ticket attack, the attacker does not follow the normal process. Instead, they forge a ticket using stolen domain-level cryptographic material. If successful, the forged ticket can appear valid to services across the domain.

This can allow the attacker to:

• Impersonate privileged users
• Access servers, databases, and file shares
• Maintain persistence after passwords are changed
• Move laterally across the network
• Evade some basic authentication checks

Why Golden Tickets Are Dangerous

A golden ticket is dangerous because it abuses trust at the domain level. Traditional account lockouts or password resets may not remove the attacker’s access if the KRBTGT secret remains unchanged.

The attack can also be difficult to detect because forged tickets may look legitimate during routine authentication. However, unusual ticket lifetimes, abnormal administrative activity, access from unexpected devices, and mismatched user behavior can indicate abuse.

Golden Ticket vs Silver Ticket

How Organizations Can Reduce Risk

Reducing the risk of golden ticket attacks requires stronger identity security and endpoint visibility. Organizations should protect domain controllers, restrict privileged accounts, monitor Kerberos activity, and rotate the KRBTGT password carefully when compromise is suspected.

Endpoint management also matters. Tools such as Hexnode can help enforce device compliance, reduce unmanaged access, and support policies that limit exposure from compromised endpoints.

Key defenses include:

• Use least privilege for administrator accounts
• Monitor suspicious Kerberos ticket behavior
• Protect domain controllers from direct user access
• Separate daily-use accounts from admin accounts
• Investigate unusual lateral movement quickly