Pass-the-Ticket.

An Active Directory attack that reuses a stolen Kerberos ticket to impersonate a user or service without ever knowing the underlying password. It belongs to the Attacks & Threats category of cybersecurity.

An Active Directory attack that reuses a stolen Kerberos ticket to impersonate a user or service without ever knowing the underlying password.

Pass-the-Ticket (PtT) abuses Kerberos by injecting a previously stolen TGT or service ticket into the current logon session and using it to access resources as the original principal. Attackers harvest tickets from LSASS memory or from kirbi files on compromised hosts, typically with Mimikatz or Rubeus, then inject them on another machine to authenticate to SMB shares, MSSQL, or DCs. MITRE ATT&CK tracks the technique as T1550.003 (Use Alternate Authentication Material: Pass the Ticket). Defences include enabling Credential Guard, enforcing short ticket lifetimes, protecting privileged accounts with the Protected Users group, monitoring Kerberos events, and detecting Mimikatz-style memory access.

Defences for Pass-the-Ticket typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: PtT.