Silver Ticket.

A forged Kerberos service ticket (TGS) created with the password hash of a target service account, granting silent access to that one service. It belongs to the Attacks & Threats category of cybersecurity.

A forged Kerberos service ticket (TGS) created with the password hash of a target service account, granting silent access to that one service.

A Silver Ticket is a TGS forged offline using the NTLM or AES hash of a specific service account, such as a SQL Server, IIS, or CIFS principal. Because the ticket is signed by the service account itself and not by krbtgt, the attacker never talks to the KDC, leaving no Kerberos authentication events on the domain controller. The attacker can then access that single service as any user, including privileged ones, for the ticket's lifetime. MITRE ATT&CK classifies the technique as T1558.002 (Steal or Forge Kerberos Tickets: Silver Ticket). Mitigations include strong service-account passwords (gMSA), AES-only Kerberos, PAC validation, and monitoring service-side authentication logs for anomalies.

Defences for Silver Ticket typically combine technical controls and operational practices, as detailed in the full definition above.