A SOC analyst is building a correlation rule to detect Golden Ticket attacks in Active Directory. Which Windows Security event sequence is most indicative of a Golden Ticket attack?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because a Golden Ticket is a forged Kerberos TGT; when used, it produces service ticket requests (Event ID 4769) without a corresponding TGT request event (4768) on the domain controller — because the TGT was forged offline and never went through normal DC authentication, making this absence a key detection indicator. A is wrong because failed logins followed by success indicate brute force or credential stuffing, not Golden Ticket.
Full explanation below image
Full Explanation
B is correct because a Golden Ticket is a forged Kerberos TGT; when used, it produces service ticket requests (Event ID 4769) without a corresponding TGT request event (4768) on the domain controller — because the TGT was forged offline and never went through normal DC authentication, making this absence a key detection indicator. A is wrong because failed logins followed by success indicate brute force or credential stuffing, not Golden Ticket. C is wrong because account creation followed by group addition indicates privilege escalation via account creation. D is wrong because explicit credential use with share access could indicate lateral movement with alternate credentials, not specifically Golden Ticket.