---
id: 5863
title: "How to Defend Against a Pass the Ticket Attack: AD Security 101"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/how-to-defend-against-pass-the-ticket-attack/"
published_at: "2024-01-11T11:40:00Z"
tags: ["active-directory", "kerberos", "defense", "detection", "lateral-movement", "mimikatz", "pass-the-ticket"]
phying_url: "https://phying.com/item/5863"
lang: en
---

# How to Defend Against a Pass the Ticket Attack: AD Security 101

## Summary

Pass the Ticket attacks abuse Kerberos: attackers extract TGTs and service tickets from memory using Rubeus, then reuse them to impersonate users and move laterally, enabling ransomware or APTs.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2024-01-11T11:40:00Z
- **Original:** https://www.semperis.com/blog/how-to-defend-against-pass-the-ticket-attack/
- **Phying News:** https://phying.com/item/5863