Which SIEM platforms have a T1550.003 detection rule?

df00tech provides T1550.003 (Pass the Ticket) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Pass the Ticket (T1550.003)?

Detecting Pass the Ticket requires the following data sources: Process: Process Creation, Logon Session: Logon Session Creation, Active Directory: Active Directory Credential Request, Microsoft Defender for Endpoint, Windows Security Event Log.

What severity and confidence is the T1550.003 detection?

The T1550.003 detection is rated critical severity with high confidence.

What are common false positives for T1550.003?

Common false positives for T1550.003 include: Security scanning and vulnerability assessment tools (e.g., BloodHound, PingCastle) that enumerate Kerberos SPNs and request service tickets for discovery; RC4 encryption remaining legitimate in environments with legacy systems (Windows Server 2003, older Unix Kerberos clients) that do not support AES, producing high volumes of 0x17 tickets; Kerberos constrained delegation (S4U2Proxy) and resource-based constrained delegation used by legitimate application servers to impersonate users, generating s4u2self/s4u2proxy patterns.

T1550.003 Sumo Logic CSE · Sumo

Detect Pass the Ticket in Sumo Logic CSE

Adversaries may 'pass the ticket' using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls and credential requirements. Pass the Ticket (PtT) involves injecting a valid Kerberos Ticket Granting Ticket (TGT) or service ticket into a current Windows logon session, allowing authentication to resources as the ticket's owner without knowing the account password. Tickets are typically obtained via OS credential dumping against LSASS memory (using tools like Mimikatz sekurlsa::tickets or Rubeus dump) and then injected with Mimikatz kerberos::ptt or Rubeus ptt. A Silver Ticket attack forges a service ticket using a compromised service account's NTLM hash, granting access to that specific service. A Golden Ticket forges a TGT using the krbtgt account hash, effectively granting domain-wide persistence. 'Overpass the Hash' uses an NTLM hash to request a legitimate Kerberos TGT, bridging Pass the Hash and Pass the Ticket. Real-world users of this technique include APT29 (Kerberos ticket attacks during Nobelium campaigns), APT32 (Cobalt Kitty operation), BRONZE BUTLER (forged TGTs for persistent administrative access), and the SeaDuke malware. The technique is operationalized primarily through Mimikatz (kerberos::ptt, sekurlsa::tickets), Rubeus (asktgt, dump, ptt, tgtdeleg), Kekeo, and Impacket (getTGT.py, getST.py, psexec.py with ccache files).

MITRE ATT&CK

Tactic: Defense Evasion Lateral Movement
Technique: T1550 Use Alternate Authentication Material
Sub-technique: T1550.003 Pass the Ticket
Canonical reference: https://attack.mitre.org/techniques/T1550/003/

Sumo Detection Query

Sumo Logic CSE (Sumo)

sql

// Signal 1: PtT Tool Execution — Sysmon EventCode 1
_sourceCategory=windows/sysmon EventCode=1
| parse regex "(?i)<Data Name='Image'>(?<Image>[^<]+)</Data>" nodrop
| parse regex "(?i)<Data Name='CommandLine'>(?<CommandLine>[^<]+)</Data>" nodrop
| parse regex "(?i)<Data Name='ParentImage'>(?<ParentImage>[^<]+)</Data>" nodrop
| parse regex "(?i)<Data Name='User'>(?<User>[^<]+)</Data>" nodrop
| where (Image matches "*mimikatz.exe" OR Image matches "*rubeus.exe" OR Image matches "*kekeo.exe")
   OR (CommandLine matches "*kerberos::ptt*" OR CommandLine matches "*sekurlsa::tickets*"
       OR CommandLine matches "*sekurlsa::krbtgt*" OR CommandLine matches "*asktgt*"
       OR CommandLine matches "*tgtdeleg*" OR CommandLine matches "*s4u2self*"
       OR CommandLine matches "*s4u2proxy*" OR CommandLine matches "*/ptt*"
       OR CommandLine matches "*.kirbi*" OR CommandLine matches "*.ccache*"
       OR CommandLine matches "*ticketer*" OR CommandLine matches "*getTGT*"
       OR CommandLine matches "*getST*" OR CommandLine matches "*harvest /interval*"
       OR CommandLine matches "*dump /nowrap*")
| eval DetectionSignal="PtT Tool Execution"
| eval ToolType=if(CommandLine matches "*kerberos::ptt*" OR CommandLine matches "*sekurlsa*", "Mimikatz",
    if(CommandLine matches "*asktgt*" OR CommandLine matches "*.kirbi*" OR CommandLine matches "*tgtdeleg*", "Rubeus",
    if(CommandLine matches "*getTGT*" OR CommandLine matches "*getST*" OR CommandLine matches "*.ccache*", "Impacket", "Unknown")))
| fields _messageTime, _sourceHost, User, Image, CommandLine, ParentImage, DetectionSignal, ToolType

// Signal 2: RC4 Kerberos Service Ticket (Event 4769)
// Run separately or union:
// _sourceCategory=windows/security EventCode=4769
// | parse regex "Ticket Encryption Type:\s+(?<TicketEncryptionType>0x\w+)" nodrop
// | parse regex "Service Name:\s+(?<ServiceName>[^\r\n]+)" nodrop
// | parse regex "Account Name:\s+(?<TargetUser>[^\r\n]+)" nodrop
// | parse regex "Client Address:\s+(?<SrcIP>[^\r\n]+)" nodrop
// | parse regex "Failure Code:\s+(?<FailureCode>0x\w+)" nodrop
// | where TicketEncryptionType="0x17"
// | where FailureCode="0x0" OR isNull(FailureCode)
// | where !matches(ServiceName, ".*\\$")
// | where !matches(TargetUser, ".*\\$")
// | eval DetectionSignal="RC4 Kerberos Downgrade (Possible Forgery)"
// | fields _messageTime, _sourceHost, TargetUser, ServiceName, TicketEncryptionType, SrcIP, DetectionSignal

// Signal 3: NewCredentials Logon Type 9 (Event 4624)
// _sourceCategory=windows/security EventCode=4624
// | parse regex "Logon Type:\s+(?<LogonType>\d+)" nodrop
// | parse regex "Authentication Package:\s+(?<AuthPackage>[^\r\n]+)" nodrop
// | parse regex field=_raw "Security ID.*?Account Name:\s+(?<SubjectUser>[^\r\n]+)" nodrop
// | where LogonType="9" AND AuthPackage="Kerberos"
// | eval DetectionSignal="Kerberos NewCredentials Logon (Possible PtT Injection)"
// | fields _messageTime, _sourceHost, SubjectUser, AuthPackage, LogonType, DetectionSignal

critical severity high confidence

Sumo Logic detection for Pass the Ticket (T1550.003) covering PtT tool execution via Sysmon process events (Mimikatz, Rubeus, Kekeo command-line patterns), RC4 Kerberos service ticket requests (Event 4769 EncType 0x17), and Kerberos logon type 9 NewCredentials events. Signal 1 is the primary active query; Signals 2 and 3 are provided as commented blocks for separate scheduling or union into a CSE rule.

Data Sources

Windows Sysmon logs via Sumo Logic CollectorWindows Security Event Log via Sumo Logic Collector

Required Tables

_sourceCategory=windows/sysmon_sourceCategory=windows/security

False Positives & Tuning

Authorized penetration testing or red team exercises using Rubeus or Mimikatz will match tool execution patterns
IT administrators using RunAs /netonly to authenticate as service accounts for remote management generate logon type 9 with Kerberos
Legacy Kerberos-capable systems or printers configured to request RC4-encrypted tickets (0x17) from the KDC in environments without AES enforcement

Download portable Sigma rule (.yml)

Other platforms for T1550.003

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Mimikatz kerberos::ptt — Inject Existing Kerberos Ticket
Expected signal: Sysmon Event ID 1: Process Create with Image=mimikatz.exe, CommandLine containing 'sekurlsa::tickets /export' and 'kerberos::ptt'. Sysmon Event ID 10: ProcessAccess event targeting lsass.exe from mimikatz.exe with GrantedAccess 0x1010 or 0x1438. Sysmon Event ID 11: File Create events for .kirbi files in the working directory. Windows Security Event ID 4769 may appear on the domain controller if tickets are subsequently used for network authentication.
Test 2Rubeus asktgt + ptt — Request and Inject TGT
Expected signal: Sysmon Event ID 1: Process Create with Image=Rubeus.exe, CommandLine containing 'asktgt', '/rc4', and '/ptt'. Windows Security Event ID 4768 on the domain controller: Kerberos Authentication Service with TicketEncryptionType=0x17 (RC4). Windows Security Event ID 4769 with TicketEncryptionType=0x17 if the TGT is then used to request service tickets. Sysmon Event ID 3: NetworkConnect from Rubeus.exe to the domain controller on port 88 (Kerberos).
Test 3Rubeus dump — Extract All Tickets from LSASS
Expected signal: Sysmon Event ID 1: Process Create with Image=Rubeus.exe, CommandLine='dump /nowrap'. Sysmon Event ID 10: ProcessAccess targeting lsass.exe from Rubeus.exe with GrantedAccess values indicating memory read (0x1010 or similar). Sysmon Event ID 11: File Create for %TEMP%\rubeus_tickets.txt. Windows Defender (if enabled) may generate alert for Rubeus.exe based on signature or behavior detection.
Test 4Impacket getTGT.py + psexec.py — Linux-to-Windows Pass the Ticket
Expected signal: Domain Controller Windows Security Event ID 4768: Kerberos Authentication Service for <USERNAME> from the Linux attack host IP. Domain Controller Event ID 4769: Service ticket request for HOST SPN on <TARGET_HOST>. Target Windows host Event ID 4624: Network Logon (Type 3) from the Linux attack host IP authenticated via Kerberos. Sysmon Event ID 1 on target host: cmd.exe spawned by psexecsvc.exe (Impacket's service executable). Target host Event ID 7045: New service 'PSEXESVC' or similar installed.

Last updated: 2026-04-20 Research depth: deep

References (13)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1550.003 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Detect Pass the Ticket in Sumo Logic CSE

MITRE ATT&CK

Sumo Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1550.003

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

MITRE ATT&CK

Sumo Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for T1550.003

Testing Methodology

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Related Techniques

Same Tactic: Defense Evasion

Popular Detections

Get new detections in your inbox