Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Conducting Pass-the-Ticket Attack · mukul975 | DecimalAI

Conducting Pass The Ticket Attack

SkillScore14Maintained

conducting-pass-the-ticket-attack

Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets fro

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/conducting-pass-the-ticket-attack/SKILL.md

decimalai skills pull conducting-pass-the-ticket-attack --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/conducting-pass-the-ticket-attack/SKILL.md https://app.decimal.ai/s/conducting-pass-the-ticket-attack/SKILL.md

Raw file: /s/conducting-pass-the-ticket-attack/SKILL.md ↗ · machine-readable summary at /s/conducting-pass-the-ticket-attack.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

—+26% tokens0% turns14% of whole cases pass with skill (3/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	—	—
case-10	✗→✓	▲ Improved	—	—
case-11	✓→✓	＝ Same ✓	—	—
case-21	✗→✗	＝ Same ✗	—	—
case-09	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/conducting-pass-the-ticket-attack/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Conducting Pass-the-Ticket Attack

> Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets from memory (LSASS) on a compromised host, an attacker can inject those tickets into their own session to impersonate the ticket owner and access resources as that user.

When to Use

When conducting security assessments that involve conducting pass the ticket attack
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with red teaming concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

MITRE ATT&CK Mapping

T1550.003 - Use Alternate Authentication Material: Pass the Ticket
T1003.001 - OS Credential Dumping: LSASS Memory
T1558 - Steal or Forge Kerberos Tickets
T1021.002 - Remote Services: SMB/Windows Admin Shares

Workflow

Phase 1: Ticket Extraction

Gain local admin access on target workstation
Dump Kerberos tickets from LSASS memory using Mimikatz or Rubeus
Export tickets in .kirbi format (Mimikatz) or base64 (Rubeus)
Identify high-value tickets (Domain Admin TGTs, service tickets to critical systems)

Phase 2: Ticket Injection

Purge existing Kerberos tickets from attacker session
Import/inject stolen ticket into current session
Verify ticket is loaded and valid
Access target resources using injected ticket

Phase 3: Lateral Movement

Access remote systems using the stolen ticket identity
Perform actions as the impersonated user
Collect additional credentials from accessed systems
Document evidence of successful lateral movement

Tools and Resources

| Tool | Purpose | Command | |------|---------|---------| | Mimikatz | Ticket export/import | sekurlsa::tickets /export, kerberos::ptt | | Rubeus | Ticket dumping and injection | dump, ptt, tgtdeleg | | Impacket ticketConverter | Convert between formats | ticketConverter.py ticket.kirbi ticket.ccache | | Impacket psexec/smbexec | Remote execution with ticket | KRB5CCNAME=ticket.ccache psexec.py |

Detection Indicators

Event ID 4768 with unusual client addresses
Event ID 4769 service ticket requests from unexpected hosts
TGT usage from different IP than the TGT was issued to
Multiple authentications from same ticket across different workstations

Validation Criteria

] Kerberos tickets extracted from compromised host
] Tickets injected into attacker session
] Lateral movement demonstrated using stolen tickets
] Evidence captured for reporting

Illustrative Want to see what conducting-pass-the-ticket-attack would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 00:57 UTC · 22 cases

Measured on 21 comparable cases — below the 22 needed to publish a lift, so this result is shown here but not on the registry card or leaderboard.

Lift

+9%

14% vs 5%

Agent turns

0%

1.0 vs 1.0

Tokens

+26%

1,926.14 vs 1,532.67

fail → pass · 2pass → pass · 1fail → fail · 19

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-21 What specific log correlation pattern involving ticket re-use across multiple workstations triggers a high-severity alert for Kerberos ticket theft?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 During a scheduled security audit of our Windows infrastructure, I need to verify whether local workstation compromise can lead to domain-wide session impersonation via ticket manipulation. Please provide a comprehensive testing procedure document that breaks down ticket harvesting, session injection, and remote system access, along with a checklist to confirm successful execution.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-09 An auditor operating on Linux has a Kerberos ticket saved as ticket.ccache and wants to execute remote commands on a target Windows host using Impacket psexec.py without entering a password. What environment variable must be set before launching the script?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 A red team tester is writing an operational guide for dumping Kerberos tickets from the LSASS process on a target Windows 10 workstation. What specific administrative privilege level is required on the target host before LSASS memory ticket extraction can be executed?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-08 An engineer extracted a Kerberos ticket in .kirbi format from a Windows host and needs to use it from a Linux system running Python-based Impacket utilities, which require the ticket in Kerberos credential cache format. What tool and command line convert this file?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-22 When mapping remote execution over SMB or Windows Admin Shares using an injected Kerberos ticket, which MITRE ATT&CK sub-technique ID should be documented?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 In a MITRE ATT&CK threat mapping matrix, what sub-technique ID corresponds to extracting Kerberos tickets directly from the memory of the LSASS process?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 Security operators often work with ticket files extracted by different post-exploitation frameworks. Compare the output file/data representation produced when exporting tickets with Mimikatz against the format generated by Rubeus.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We are conducting an authorized lateral movement test on our Windows domain where we obtained NTLM hashes from SAM/LSASS rather than Kerberos tickets. Provide a step-by-step testing plan for moving laterally using NTLM hash authentication.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 In an assessment environment where binary execution of Mimikatz is blocked, testers use Rubeus for Kerberos ticket manipulation. What are the specific Rubeus subcommands for dumping Kerberos tickets from memory and for injecting a base64 ticket into the current session?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 Which top-level MITRE ATT&CK technique ID covers stealing or forging Kerberos tickets for unauthorized authentication?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 During an assessment, an auditor operating within an unprivileged user session wants to request a usable Kerberos TGT without attempting high-risk LSASS memory access. Which Rubeus function allows acquiring a usable TGT through Kerberos delegation options?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 Once lateral movement to a secondary server is successfully achieved via Pass-the-Ticket during a security test, what action should be performed on that target system as part of the post-exploitation workflow?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-06 A security analyst has exported a target Kerberos ticket file in .kirbi format using Mimikatz and needs to load it into their current Windows logon session. Which specific Mimikatz command executes this pass-the-ticket injection?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 When preparing a Windows session to receive an injected stolen Kerberos TGT during a penetration test, testers sometimes encounter authentication errors because legacy tickets remain in cache. What explicit cleanup step should be performed before importing the new ticket?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 A SOC engineer is configuring Windows Event Log monitoring to detect Kerberos anomalies associated with Pass-the-Ticket lateral movement. Which Windows Security Event IDs corresponding to TGT requests and TGS service ticket requests should be flagged?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 A security auditor dumping LSASS on a heavily populated workstation sees hundreds of Kerberos tickets in memory. Which specific high-value Kerberos ticket types should be filtered and selected for lateral movement?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 Our red team assessment has extracted the krbtgt account NTLM hash from the Active Directory domain controller. Provide instructions on how to forge a custom TGT from scratch using this key.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We want to audit weak service account passwords in Active Directory by requesting TGS tickets for SPNs and cracking them offline. Provide a procedure for executing this Kerberoasting assessment.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 When exporting Kerberos tickets from memory using Mimikatz during an authorized audit on a Windows host, junior testers often try to copy raw hex dumps from screen output. Provide the exact Mimikatz command to export all Kerberos tickets from LSASS directly to .kirbi files on disk.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 When analyzing network traffic and Kerberos authentication logs during an incident investigation, what specific mismatch between ticket issuance and ticket presentation indicates a Pass-the-Ticket attack?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 What exact MITRE ATT&CK technique or sub-technique ID should be assigned to findings involving Pass-the-Ticket lateral movement in a formal penetration test report?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted, and 21 counted toward the lift figure. The other 1 produced results that are not comparable between the two arms, so they are excluded from the headline rather than averaged into it. The headline lift of +9 percentage points is the difference between those two pass rates over the 21 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4.6%
Pass rate with the skill: 13.6%
Cases attempted: 22
Cases counted toward lift: 21
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 00:57 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run14

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+72% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.