Question

During a proactive threat hunt, an analyst reviews Kerberos authentication telemetry from domain controllers. They discover a Ticket Granting Ticket (TGT) with a validity lifetime of 10 years being used to request service tickets across multiple servers, and the associated account SID history contains entries that do not match any current group membership. The account's password was last changed six months ago, yet the ticket appears freshly issued. Which conclusion best fits this evidence, and what should the analyst prioritize next?

Accepted Answer

This indicates a Golden Ticket forged with the KRBTGT hash; prioritize a double KRBTGT password reset and scope which systems accepted the forged tickets

Answer

This is expected behavior from a service account with a long-lived credential; document it as a false positive and tune the detection to ignore long ticket lifetimes

Answer

This indicates a Pass-the-Hash attack against a local administrator account; prioritize resetting the local SAM database on affected endpoints

Answer

This indicates a Kerberoasting attack harvesting service account hashes; prioritize enforcing AES encryption and longer service account passwords