ryuki's blog

            • Corporate
            • FormulaX
            • Headless
            • Jab
            • Mist
            • Office
            • Perfection
            • Skyfall
            • WifineticTwo
            • Axlle
            • Blazorized
            • Blurry
            • BoardLight
            • Editorial
            • Freelancer
            • Ghost
            • Intuition
            • MagicGardens
            • Mailing
            • PermX
            • Runner
            • SolarLab
            • Caption
            • Chemistry
            • Cicada
            • Infiltrator
            • Instant
            • Lantern
            • MonitorsThree
            • Resource
            • Sea
            • Sightless
            • Trickster
            • University
            • Yummy
            • Backfire
            • BigBang
            • Cat
            • Checker
            • Code
            • Cypher
            • DarkCorp
            • Dog
            • EscapeTwo
            • Haze
            • TheFrizz
            • Titanic
            • Artificial
            • Certificate
            • Editor
            • Era
            • Fluffy
            • Mirage
            • Outbound
            • Puppy
            • RustyKey
            • TombWatcher
            • Voleur
            • Administrator
            • Alert
            • BlockBlock
            • Certified
            • Compiled
            • Environment
            • Eureka
            • GreenHorn
            • Heal
            • IClean
            • LinkVortex
            • Nocturnal
            • Planning
            • Scepter
            • UnderPass
            • Usage
            • Vintage
          • Baby
          • Build
          • Down
          • Escape
      root

      /

      tags

      /

      Steal or Forge Kerberos Tickets (T1558)

      Steal or Forge Kerberos Tickets (T1558)

      Jan 01, 19701 min read

      Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.

      Tactics
      TA0006

      Sub-techniques
      T1558.001 T1558.002 T1558.003 T1558.004


      See: MITRE ATT&CK

      6 items with this tag.

      • Nov 22, 2025

        Mirage

        • hackthebox
        • hard
        • windows
        • dns
        • nats
        • esc10
        • adcs
        • gmsa
        • kerberoast
        • T1078
        • T1078.002
        • T1078.003
        • T1098
        • T1098.007
        • T1110
        • T1110.002
        • T1187
        • T1550
        • T1550.002
        • T1550.003
        • T1557
        • T1558
        • T1558.003
      • Oct 18, 2025

        DarkCorp

        • hackthebox
        • insane
        • windows
        • sql-injection
        • phishing
        • ntlmrelayx
        • krbrelayx
        • esc8
        • adcs
        • dns
        • ntlm
        • gpo
        • dpapi
        • mail
        • pygpoabuse
        • SharpDPAPI
        • roundcube
        • T1003
        • T1003.005
        • T1078
        • T1078.002
        • T1078.003
        • T1098
        • T1098.007
        • T1110
        • T1110.002
        • T1110.003
        • T1187
        • T1190
        • T1550
        • T1550.002
        • T1550.003
        • T1552
        • T1552.001
        • T1555
        • T1555.005
        • T1558
        • T1558.002
        • T1566
      • Apr 19, 2025

        Administrator

        • hackthebox
        • windows
        • medium
        • kerberoast
        • targeted-kerberoast
        • dcsync
        • ftp
        • pwsafe
        • T1003
        • T1003.006
        • T1078
        • T1078.002
        • T1098
        • T1110
        • T1110.002
        • T1555
        • T1555.004
        • T1558
        • T1558.003
      • Apr 05, 2025

        Ghost

        • hackthebox
        • ctf
        • windows
        • insane
        • gitea
        • ldap-injection
        • goldensaml
        • SigmaPotato
        • sliver
        • amsi
        • adfs
        • gmsa
        • saml
        • mssql
        • linked-database
        • T1003
        • T1059
        • T1068
        • T1078
        • T1110
        • T1190
        • T1550
        • T1552
        • T1558
        • T1562
        • T1562.001
        • T1606
      • Nov 09, 2024

        Blazorized

        • hackthebox
        • ctf
        • windows
        • hard
        • blazor
        • web-assembly
        • script-path
        • kerberoasting
        • dcsync
        • jwt
        • dnspy
        • dll
        • T1078
        • T1078.002
        • T1098
        • T1110
        • T1110.002
        • T1558
        • T1558.003
        • T1606
        • T1606.001
      • Oct 26, 2024

        Mist

        • hackthebox
        • ctf
        • windows
        • insane
        • adcs
        • ecs13
        • pluckcms
        • lnk
        • petitpotam
        • coerce
        • webdav
        • ntlmrelayx
        • certify
        • rubeus
        • shadow-credentials
        • mask
        • hashcat
        • oid-group-link
        • backup-operators
        • T1003
        • T1003.002
        • T1003.006
        • T1078
        • T1078.002
        • T1098
        • T1110
        • T1110.002
        • T1187
        • T1190
        • T1555
        • T1555.005
        • T1558
        • T1558.002

      Recent ...

      • Editor

        Dec 06, 2025

      • Era

        Nov 29, 2025

      • Mirage

        Nov 22, 2025

      • Outbound

        Nov 15, 2025

      • RustyKey

        Nov 08, 2025

      Created with ❤️ and Quartz

      • Mastodon
      • Bluesky
      • GitHub