Pass the Ticket
Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system. When preforming PtT, valid Kerberos tickets for [Valid Accounts](https://attack.mitre.org/techniques/T1078) are captured by ...
BY SOURCE
PROCEDURES (9)
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for spray
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for kerbero
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for process creation monitoring