A security team is investigating an attack where the adversary used a 'pass-the-ticket' attack. What Windows Kerberos artifact does this attack use and where is it stored?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because pass-the-ticket attacks extract Kerberos tickets (TGTs or service tickets) from LSASS memory (using tools like Mimikatz's sekurlsa::tickets or kerberos::list) and inject them into another session using kerberos::ptt, granting access to the resources those tickets authorize without needing the account password. A is wrong because pass-the-hash uses NTLM hashes from the SAM; pass-the-ticket is a distinct attack using Kerberos tickets.
Full explanation below image
Full Explanation
B is correct because pass-the-ticket attacks extract Kerberos tickets (TGTs or service tickets) from LSASS memory (using tools like Mimikatz's sekurlsa::tickets or kerberos::list) and inject them into another session using kerberos::ptt, granting access to the resources those tickets authorize without needing the account password. A is wrong because pass-the-hash uses NTLM hashes from the SAM; pass-the-ticket is a distinct attack using Kerberos tickets. C is wrong because cached credentials (MSCacheV2) are used for offline logon when the DC is unreachable; they are not Kerberos tickets and cannot be used for pass-the-ticket. D is wrong because DPAPI master keys protect encrypted data (browser passwords, credentials manager); they are unrelated to Kerberos ticket attacks.