A security team is investigating an attack where the adversary used a 'pass-the-ticket' attack. What Windows Kerberos artifact does this attack use and where is it stored?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — pass-the-ticket attacks use Kerberos Ticket Granting Tickets or Service Tickets from LSASS process memory. You extract those tickets and inject them into another session, then access the resources they authorize without needing the account password.
Full Explanation
The correct answer is the Kerberos Ticket Granting Tickets (TGTs) or Service Tickets stored in the LSASS process memory (logon session), which can be extracted and injected into another session. Pass-the-ticket attacks work by pulling Kerberos tickets from LSASS memory, using tools such as Mimikatz's sekurlsa::tickets or kerberos::list, and then injecting them into another session with kerberos::ptt. That gives access to the resources those tickets authorize without needing the account password. The NTLM password hashes stored in the SAM database are wrong because pass-the-hash uses NTLM hashes from the SAM; pass-the-ticket is a distinct attack that uses Kerberos tickets. The cached domain credentials stored in HKLM\SECURITY\Cache registry key are wrong because cached credentials (MSCacheV2) are used for offline logon when the domain controller is unreachable; they are not Kerberos tickets and cannot be used for pass-the-ticket. The DPAPI master keys stored in the user profile's AppData directory are wrong because DPAPI master keys protect encrypted data such as browser passwords and Credential Manager data; they are unrelated to Kerberos ticket attacks.