detecting-golden-ticket-forgery
by mukul975detecting-golden-ticket-forgery detects Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769, RC4 downgrade use (0x17), abnormal ticket lifetimes, and krbtgt anomalies in Splunk and Elastic. Built for Security Audit, incident investigation, and threat hunting with practical detection guidance.
This skill scores 78/100, which means it is a solid listing candidate for directory users who need a focused Golden Ticket detection workflow. The repository gives enough concrete detection logic, query examples, and a runnable parsing script to reduce guesswork versus a generic prompt, though it still needs clearer operational boundaries and setup guidance.
- Specific trigger and use case: detects Kerberos Golden Ticket forgery via Event IDs 4768/4769, RC4 downgrades, ticket lifetime anomalies, and krbtgt anomalies.
- Operational leverage: includes Splunk SPL examples and a Python script for parsing exported Windows Security XML logs.
- Good reference depth: the API reference maps indicators to event fields and detection patterns, helping agents act on the skill quickly.
- Prerequisites are truncated in the excerpt, so install users may not get a complete picture of required log sources or environment assumptions.
- No install command or quick-start packaging is present, so adoption may require manual interpretation of the script and reference files.
Overview of detecting-golden-ticket-forgery skill
What this skill does
The detecting-golden-ticket-forgery skill helps analysts detect Kerberos Golden Ticket abuse by focusing on the signals that matter in real environments: suspicious Event ID 4769 activity, RC4 downgrade use in AES-focused domains, unusually long ticket lifetimes, and krbtgt-related anomalies. It is best for Security Audit work, incident investigation, and detection engineering where you need a practical starting point rather than a generic ATT&CK summary.
Who should use it
Use this detecting-golden-ticket-forgery skill if you work with Windows domain telemetry in Splunk or Elastic and need to turn noisy authentication data into a defensible detection workflow. It is a good fit for SOC analysts, threat hunters, and detection engineers who already have access to Security logs and want clearer triage logic.
Why it is worth installing
The main value is not just “find Golden Tickets,” but helping you decide what to inspect first: 4769 encryption type, absence of expected 4768 context, and domain-policy outliers. That makes the detecting-golden-ticket-forgery install useful when you need repeatable hunting logic, not just a one-off prompt.
How to Use detecting-golden-ticket-forgery skill
Install and place it in context
Install the detecting-golden-ticket-forgery skill with:
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-golden-ticket-forgery
Then read skills/detecting-golden-ticket-forgery/SKILL.md first, followed by references/api-reference.md and scripts/agent.py. Those files show the detection logic, the event fields the skill expects, and the script path if you want to automate parsing or adapt the workflow.
Give it the right input
For strong detecting-golden-ticket-forgery usage, tell the skill three things up front: your log source, your SIEM, and what “normal” looks like in your domain. A weak request is “check for Golden Tickets.” A better one is: “Build a Splunk hunt for Event ID 4769 with RC4 0x17, exclude known service accounts, and explain how to confirm whether 4768 exists for the same user.”
Start from a detection workflow
The most useful detecting-golden-ticket-forgery guide pattern is:
- confirm whether your environment should prefer AES,
- inspect 4769 for
TicketEncryptionType=0x17, - correlate with 4768 and 4624 where available,
- compare ticket lifetime and account behavior against policy,
- separate likely abuse from legacy Kerberos or service-account noise.
This workflow keeps the skill anchored to evidence instead of broad suspicion.
Read these files first
If you want fast setup, preview SKILL.md for the detection intent, references/api-reference.md for the key event IDs and example Splunk queries, and scripts/agent.py for how the repository models event parsing. That sequence helps you understand the skill before you try to reuse it in your own environment.
detecting-golden-ticket-forgery skill FAQ
Is this only for Splunk?
No. The repository includes Splunk examples, but the detecting-golden-ticket-forgery skill is really about the detection logic behind the query. You can adapt the same indicators to Elastic, custom Python parsing, or a SIEM pipeline as long as you have Windows Security event data.
What is the main detection signal?
The strongest recurring signal is suspicious 4769 behavior, especially RC4 0x17 in environments that should be using AES. The skill also cares about missing or mismatched 4768 context, abnormal lifetimes, and krbtgt anomalies, because any single signal can be noisy on its own.
Is it beginner-friendly?
It is beginner-friendly for analysts who already know basic Windows auth terms, but not for someone who wants a plain-English intro to Kerberos. The detecting-golden-ticket-forgery guide is more useful if you can interpret event IDs, ticket types, and domain policy assumptions.
When should I not use it?
Do not rely on it alone when you only have partial logs, heavily legacy environments, or cases where RC4 is still normal for legitimate reasons. In those situations, the skill can still help structure your review, but it should not be treated as a final verdict without local baselines.
How to Improve detecting-golden-ticket-forgery skill
Provide environment-specific baselines
The biggest quality jump comes from telling the skill what “expected” means in your domain: AES policy, normal ticket lifetime, privileged service accounts, and known legacy systems. Without those details, detecting-golden-ticket-forgery usage can over-flag legitimate activity.
Ask for one output type at a time
Better results come from narrow asks: a hunt query, a triage checklist, a false-positive filter list, or an analyst note. If you ask for all four at once, the output is usually less actionable than a focused detecting-golden-ticket-forgery for Security Audit request.
Watch for the common failure modes
The most common mistakes are treating every RC4 ticket as malicious, ignoring service-account exceptions, and skipping correlation with 4768. When you iterate, ask the skill to explain why each indicator matters and what benign cases could mimic it.
Improve the second pass
After the first output, feed back the gaps: your SIEM field names, missing log sources, or a sample alert you already trust. Then ask the detecting-golden-ticket-forgery skill to tighten the query, reduce noise, or rewrite the investigation steps for your exact environment.