[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/) [![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/) Menu * [Tools](https://unit42.paloaltonetworks.com/tools/) * [ATOMs](https://unit42.paloaltonetworks.com/atoms/) * [Security Consulting](https://www.paloaltonetworks.com/unit42) * [About Us](https://unit42.paloaltonetworks.com/about-unit-42/) * [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html) English * [English](https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks/) * [Japanese](https://unit42.paloaltonetworks.com/ja/next-gen-kerberos-attacks/) * [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research") * [Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/ "Learning Hub") [Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) # Precious Gemstones: The New Generation of Kerberos Attacks ![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 14 min read Related Products [![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR") * ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg) By: * [Oz Soprin](https://unit42.paloaltonetworks.com/author/oz-soprin/) * [Shachar Roitman](https://unit42.paloaltonetworks.com/author/shachar-roitman/) * ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg) Published:December 12, 2022 * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg) Categories: * [Cloud Cybersecurity Research](https://unit42.paloaltonetworks.com/category/cloud-cybersecurity-research/) * [Learning Hub](https://unit42.paloaltonetworks.com/category/learning-hub/) * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) * ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg) Tags: * [Diamond Ticket](https://unit42.paloaltonetworks.com/tag/diamond-ticket/) * [Golden Ticket](https://unit42.paloaltonetworks.com/tag/golden-ticket/) * [Kerberos](https://unit42.paloaltonetworks.com/tag/kerberos/) * [Privilege escalation](https://unit42.paloaltonetworks.com/tag/privilege-escalation/) * [Sapphire Ticket](https://unit42.paloaltonetworks.com/tag/sapphire-ticket/) * [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks/?pdf=download&lg=en&_wpnonce=5f0cc26d8b "Click here to download") * [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks/?pdf=print&lg=en&_wpnonce=5f0cc26d8b "Click here to print") Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg) * ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg) * [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=Precious%20Gemstones:%20The%20New%20Generation%20of%20Kerberos%20Attacks&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnext-gen-kerberos-attacks%2F "Share in email") * [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnext-gen-kerberos-attacks%2F "Share in Facebook") * [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnext-gen-kerberos-attacks%2F&title=Precious%20Gemstones:%20The%20New%20Generation%20of%20Kerberos%20Attacks "Share in LinkedIn") * [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnext-gen-kerberos-attacks%2F&text=Precious%20Gemstones:%20The%20New%20Generation%20of%20Kerberos%20Attacks "Share in Twitter") * [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Fnext-gen-kerberos-attacks%2F&ts=markdown "Share in Reddit") * [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=Precious%20Gemstones:%20The%20New%20Generation%20of%20Kerberos%20Attacks%20https%3A%2F%2Funit42.paloaltonetworks.com%2Fnext-gen-kerberos-attacks%2F "Share in Mastodon") ## Executive Summary Unit 42 researchers show new detection methods that help improve detection of a new line of Kerberos attacks, which allow attackers to modify Kerberos tickets to maintain privileged access. The most well-known example of this is the Golden Ticket attack, which allows threat actors to forge a ticket to masquerade as a high-privileged user. These two newer attacks extend the Golden Ticket attack in that the forged tickets are not created from scratch, but instead based on modifying an existing ticket to include high-privileged access. We'll discuss the difference between these three types of attacks, to explain why the newer ones are harder to detect. The broad usage of Active Directory has made Kerberos attacks the bread and butter of many threat actors. Researchers have discovered the following new attack techniques that allow an adversary to gain unconstrained access to all services and resources within an Active Directory (AD) domain: * Diamond Ticket * Sapphire Ticket Because of their similarity to the well-known Golden Ticket attack, threat actors might also use these attacks in future campaigns. People can better protect themselves by employing the new detection methods we'll discuss for these new Kerberos attacks. Palo Alto Networks customers receive improved detection for the attacks discussed in this blog through Cortex XDR. |----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Related Unit 42 Topics** | [privilege escalation](https://unit42.paloaltonetworks.com/tag/privilege-escalation/), [Golden Ticket](https://www.paloaltonetworks.com/blog/tag/golden-ticket/), [Kerberos](https://unit42.paloaltonetworks.com/tag/kerberos/) | ## Kerberos Refresher To understand the ticket attacks and their implications, it helps to understand a few things about how Kerberos works. This includes some common terms for features used in these attacks, as well as the structure of how tickets are used. [Kerberos]() is a network authentication protocol that is primarily used in [Active Directory (AD)](https://en.wikipedia.org/wiki/Active_Directory) environments. [Thousands of companies across different industries](https://discovery.hgdata.com/product/microsoft-active-directory) use Active Directory technology for managing user accounts and other resources within an organization. Active Directory's first version was released in Windows Server 2000 and since then, it has become particularly common in businesses and other large organizations that have a significant number of users and resources to manage. Kerberos provides strong authentication by issuing tickets to authenticate users and allow access to services. The tickets are distributed by the [key distribution center (KDC)](https://www.techopedia.com/definition/12883/key-distribution-center-kdc-cryptography). In most environments, the KDC is installed on the [domain controller (DC)](https://en.wikipedia.org/wiki/Domain_controller). During the initial authentication, a [Ticket Granting Ticket (TGT)](https://doubleoctopus.com/security-wiki/authentication/ticket-granting-tickets/) is a ticket assigned to a user. The TGT is later used to authenticate the user to the KDC and request a service ticket from the [Ticket Granting Service (TGS)](). Service tickets are granted for authentication against services. A Kerberos authentication would consist of the following steps: 1. The user requests (AS-REQ) a TGT from the KDC and the KDC verifies and validates the credentials and user information. 2. After authenticating the user, the KDC sends an encrypted TGT back to the requester (AS-REP). 3. The user presents the TGT to the DC and requests a TGS (TGS-REQ). 4. The TGS is encrypted and sent back to the requesting user (TGS-REP). 5. The user connects to the server hosting the service requested and presents the TGS (AP-REQ) in order to access the service. 6. The application server sends an (AP-REP) to the client. ![Image 1 shows the request flow between the user workstation, the domain controller, and the application server for Kerberos authentication](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/12/word-image-28.png) Figure 1. Kerberos authentication. ### What Components Are in a Kerberos Ticket? Each [Kerberos ticket](https://www.rfc-editor.org/rfc/rfc4120#section-5.3) contains the following fields: |--------------|---------------------------------------------------------------------------------------| | **Kerberos Ticket** || | **Tkt-vno** | Version number for the ticket format. | | **Realm** | The realm that issued a ticket. | | **sname** | Server name. All the components of the name are part of the server's identity. | | **Enc-part** | Encrypted with the server's secret key. | *Table 1. Kerberos ticket.* The enc-part contains different fields but we will focus on the following: 1. cname -- The name part of the client's principal identifier. 2. authorization-data -- used to pass authorization data from the principal on whose behalf a ticket was issued to the application service. This part includes the Privileged Attribute Certificate (PAC). ### What Is a Kerberos Privilege Attribute Certificate (PAC)? As [Microsoft's documentation](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/54d570b1-fc54-4c54-8218-f770440ec334) states, the [PAC](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/54d570b1-fc54-4c54-8218-f770440ec334) is a structure that conveys authorization-related information provided by DCs. The PAC is used by authentication protocols that verify identities to transport authorization information, which controls access to resources. The DC includes authorization data such as [security identifiers (SIDs)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/f2ef15b6-1e9b-48b5-bf0b-019f061d41c8#gt_83f2020d-0804-4840-a5ac-e06439d50f8d) and [relative identifiers (RIDs)](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/f2ef15b6-1e9b-48b5-bf0b-019f061d41c8#gt_df3d0b61-56cd-4dac-9402-982f1fedc41c) in the PAC. ### Kerberos Delegation A common use case for [Kerberos delegation](https://blog.netwrix.com/2021/11/30/what-is-kerberos-delegation-an-overview-of-kerberos-delegation/#:~:text=Kerberos%20Delegation%20is%20a%20security,account%20for%20any%20other%20network) is a web server fetching user data from a database server. The database server can grant access to the user data only for the user. In this scenario, the web server will need to impersonate the user. This impersonation is called Kerberos delegation. We will focus on constrained delegation in this blog, but you can read about the different Kerberos delegation methods in [Protecting Against the Bronze Bit Vulnerability with Cortex XDR](https://www.paloaltonetworks.com/blog/security-operations/bronze-bit-vulnerability-xdr/). **Constrained Delegation:** Microsoft has implemented Kerberos extensions in order to avoid keeping the user's TGT in memory. This extension is called [S4U](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/4a624fb5-a078-4d30-8ad1-e9ab71e0bc47#gt_083a5403-f654-4db6-b17e-9c10dc5cd420) (Service for User), and it consists of [S4U2Self](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/4a624fb5-a078-4d30-8ad1-e9ab71e0bc47#gt_2214804a-4a44-46f4-b6d2-a78f4ff39a39) and [S4U2Proxy](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/bde93b0e-f3c9-4ddf-9f44-e1453be7af5a). S4U2Self allows a service to ask for a ticket to itself on behalf of any user. S4U2Proxy will allow a service to authenticate to a different service. ### S4U2Self Extension As described above, the [S4U2self](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/4a624fb5-a078-4d30-8ad1-e9ab71e0bc47#gt_2214804a-4a44-46f4-b6d2-a78f4ff39a39) extension allows a [service](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/4a624fb5-a078-4d30-8ad1-e9ab71e0bc47#gt_2dc07ca2-2b40-437e-a5ec-ed28ebfb116a) to receive the user's [authorization data](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/4a624fb5-a078-4d30-8ad1-e9ab71e0bc47#gt_0eef5aca-03f3-4b09-b79b-cdf7f730ad89) in the ticket (i.e., the PAC). To use this protocol extension, the user that issues the [KRB\_TGS\_REQ](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/b4af186e-b2ff-43f9-b18e-eedb366abf13) must have at least one [Service Principal Name (SPN)](https://learn.microsoft.com/en-us/windows/win32/ad/service-principal-names) to allow the DC to encrypt the generated service ticket with the service secret key. S4U2U KRB\_TGS exchange flow: 1. The service fills out the [PA\_FOR\_USER](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/aceb70de-40f0-4409-87fa-df00ca145f5a) data structure, which contains the information about the user on whose behalf the service requests the service ticket, and sends the KRB\_TGS\_REQ message to the TGS. 2. The service ticket will be sent back to the service via KRB\_TGS\_REQ message. The PAC returned in the service ticket contains the authorization data. ### U2U Authentication [User-to-User authentication](https://www.rfc-editor.org/rfc/rfc4120#section-3.7) is described in the Kerberos RFC as a method that "allows the client to request that the ticket issued by the KDC be encrypted using a session key from a TGT issued to the party that will verify the authentication." The KRB\_TGS\_REQ will have the following features: * [additional-tickets](https://www.rfc-editor.org/rfc/rfc4120#section-5.4.1): will contain the TGT from which the secret-key is taken * [ENC-TKT-IN-SKEY](https://www.rfc-editor.org/rfc/rfc4120#section-2.9.2): option indicates that the ticket for the end server is to be encrypted in the session key from the additional TGT provided. * The service name (sname) can refer to a user and not necessarily a service with SPN. ### U2U + S4U2Self Combining the two methods together allows using the S4U2Self extension for users with no SPN. The service ticket received in this exchange is encrypted with the server's secret-key (in this specific case the server can be a user with no SPN), therefore, the PAC of the target user can be decrypted using the server's secret-key. The KRB\_TGS\_REQ packet will have all the features of both methods. ## How Do These Kerberos Attacks Work? Both the Sapphire and Diamond Ticket attacks decrypt a legitimate TGT and change its PAC, and in order to do that, the adversary needs to have access to the [KRBTGT](https://adsecurity.org/?p=483) account's key (the password hash). The KRBTGT account, as described by [Microsoft TechNet (now Microsoft Docs)](), is a local default account that acts as a service account for the KDC service\*.\* ### Sapphire Ticket The Sapphire ticket attack (introduced by [Charlie Bromberg](https://twitter.com/_nwodtuhs)), requires getting credentials of any user in the domain. Let's call that user Joe. Joe's credentials will be used to obtain a TGT (using a regular [KRB\_AS\_REQ](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/b4af186e-b2ff-43f9-b18e-eedb366abf13)) and later to decrypt the PAC of a high-privileged user. Once the TGT is received, the adversary will use the U2U + S4U2Self: 1. Decide on the user they want to impersonate (high-privileged user) 2. Generate a KRB\_TGS\_REQ with the following attributes: 1. The PA\_FOR\_USER struct contains the impersonated user 2. The service name (sname) is Joe's username 3. Joe's TGT will be added to the additional-tickets field 4. ENC-TKT-IN-SKEY flag in the KDC Option is set 3. Obtain a service ticket for the impersonated user KRB\_TGS\_REQ - ![Image 2 is many lines of code and shows how to generate KRB\_TGS\_REQ using U2U + S4U2Self with a user named Joe.2 and](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/12/word-image-29.png) Figure 2. KRB\_TGS\_REQ created using U2U + S4U2Self methods. ![Image 3 is many lines of code where the user named Joe begins to set configuration options.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/12/word-image-30.png) Figure 3. ENC-TKT-IN-SKEY flag is set in the KDC Option. KRB\_TGS\_REP ![Image 4 is a few lines of code continuing to show how a user named Joe continues to set configuration options through the process.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/12/word-image-31.png) Figure 4. U2U + S4U2Self TGS-REP. As we know, a service ticket is encrypted with the service's long-term secret, which means that if the adversary has Joe's credentials, they will be able to decrypt the service ticket. The adversary also has the KRBTGT account's secret key and therefore they can decrypt and modify Joe's TGT, which is signed with said secret key. To forge the Sapphire Ticket, the attacker will extract the PAC of the impersonated user, and modify Joe's TGT in 2 ways: 1. Replace Joe's original PAC with the high-privileged PAC. 2. Match the cname to be the impersonated user's name. This gives the attacker a usable TGT of a high-privileged user. ### Diamond Ticket The first part of the Diamond Ticket attack (introduced by [Charlie Clark](https://twitter.com/exploitph) and [Andrew Schwartz](https://twitter.com/4ndr3w6s)) is obtaining a TGT. This can be done by using one of the following techniques: * Adversaries will use the low-privileged user's credentials to initiate a KRB\_AS\_REQ, which will result in a legitimate TGT. * A tool called [Rubeus](https://github.com/GhostPack/Rubeus) has an option called [tgtdeleg](https://github.com/GhostPack/Rubeus#tgtdeleg) that abuses the Kerberos [Generic Security Services Application Program Interface (GSS-API)](https://en.wikipedia.org/wiki/Generic_Security_Services_Application_Program_Interface) to retrieve a usable TGT for the current user without needing elevation on the host. Once receiving the TGT in the [KRB\_AS\_REP](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/b4af186e-b2ff-43f9-b18e-eedb366abf13), the adversary can now decrypt the TGT using the KRBTGT account's key and modify each part of the ticket. After modifying the ticket, an attacker can escalate their privileges using one of the following approaches: * Generating a TGT to impersonate a domain admin or any other user in the domain. In this scenario the attacker will need to change the cname field in the ticket as well as the PAC. This method will result in a forged ticket under the name of the domain admin (or any other user in the domain), which is pretty similar to the [Golden Ticket](https://attack.mitre.org/techniques/T1558/001/) attack. * Elevating a normal domain user's privileges to domain admin privileges by modifying the PAC. This method will supply the attacker with a ticket under the name of the low-privileged user with domain admin permissions. ## How Powerful Are the New Kerberos Attacks? Diamond and Sapphire Tickets are forged TGTs created by modifying a legitimate TGT, which gives it additional privileges or a new identity. While many Golden Ticket detections are based on the absence of a TGT creation by a legitimate DC, the new attacks manipulate a legitimate TGT that was issued by the DC, which makes them harder to detect. After the TGT is forged, the attacker uses it to request a TGS to any service or resource they desire. For example, they can request access to all computers, files and folders in the domain. ### What's the Difference Between a Diamond Ticket and a Sapphire Ticket Attack? In both attacks, the manipulation happens on the PAC of a legitimate TGT, but the main difference is in the way it is modified. With a Diamond Ticket, the modification is to the original PAC of the requested TGT, by adding additional privileges or modifying it completely. With a Sapphire Ticket, the attacker modifies the TGT by getting a legitimate PAC of a high-privileged user using Kerberos delegation, and replaces it with the original ticket's PAC. ### Can Anyone Forge TGTs? In order to perform such an attack, the basic requirement is that the adversary needs access to the [KRBTGT](https://adsecurity.org/?p=483) account's password hash. The KRBTGT account encrypts and signs all the Kerberos TGT tickets for the domain. All verification of Kerberos tickets, including encrypting and decrypting TGTs for the KDC service, is done by the KRBTGT. This means a forged TGT will be considered a valid ticket simply because it was encrypted with the KRBTGT account. Moreover, the adversary has to encrypt the forged TGT with the KRBTGT password hash once the TGT is forged, to make sure the new TGT will pass the KDC's verification and issue a service ticket to the desired service. With that being said, it's important to remember that getting the KRBTGT password hash is not an easy task. Doing so not only provides access to all the services and resources in the domain, but also enables network persistence. ## Forged Ticket Attacks in the Wild Forged ticket attacks have been sighted in the wild, such as in attacks by [Playful Taurus](https://attack.mitre.org/groups/G0004/), also known as APT15, [Ke3chang](https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/) and NICKEL. This group is attributed to actors operating out of China and has targeted oil, government, diplomatic, military and non-governmental organizations around the world since 2010. An [investigation done by NCC Group's IR team](https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/) in May 2017 states that, to gain persistence in the victim's network in the event of remediation actions being undertaken, Playful Taurus used [Mimikatz](https://attack.mitre.org/software/S0002/) to dump credentials and generate Kerberos Golden Tickets. In a different campaign around December 2021, [MSTIC](https://www.microsoft.com/en-us/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe/) found that the same threat actor used malicious tools such as Mimikatz, WDigest, NTDSDump, and other password-dumping tools to gather credentials on a targeted system. Mimikatz allows attackers to perform the following activities: * Gathering credentials * Performing [DCSync attacks](https://attack.mitre.org/techniques/T1003/006/) These simulate the [Active Directory replication](https://social.technet.microsoft.com/wiki/contents/articles/4592.how-active-directory-replication-works.aspx) process and retrieve the user's password hash. They can be used to collect the KRBTGT password hash. * Forge a Golden Ticket Our assumption is that -- because Sapphire and Diamond Ticket attacks resemble Golden Ticket attacks but are harder to discover -- different threat actors (like Playful Taurus) are likely to use these attacks in the future. ## Proposing Detection Methods for Forged Ticket Attacks Due to the difficulty of finding the KRBTGT password hash, these attacks would probably cause a lot of noise even before the attack took place. In this case, the detection ideas that apply to Golden Ticket attacks are relevant here as well. If you want to read more about such detections, check out our blog, [Detecting and Preventing the Path to a Golden Ticket With Cortex XDR](https://www.paloaltonetworks.com/blog/security-operations/detecting-and-preventing-the-path-to-a-golden-ticket-with-cortex-xdr/). ### Sapphire Ticket Since the Sapphire Ticket should appear valid (i.e., a ticket with a legitimate PAC), we would have a difficult time detecting its utilization solely by analyzing it. However, we can detect other suspicious activities on the host: * Signs of KRBTGT password hash theft * Suspicious tools usage * DCSync attacks in the environment or suspicious connections from the host to a DC * Irregular KRB\_TGS\_REQ with U2U + S4U2Self attributes * KRB\_TGS\_REQ by a high-privileged user from that host If the adversary uses the ticket right after performing the attack, we will observe a TGT request and TGS from the same IP for two different users. There would be no indication for the second user's (i.e., the one that appears in the TGS request) authentication to that machine. This can be monitored by Windows Event 4768 and 4769 as well as network traffic. ![Image 5 is a screenshot of a TGT request by a low-privileged user with the account name for user Joe highlighted. The Client Address is also highlighted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/12/word-image-32.png) Figure 5. TGT request by low-privileged user. ![Image 6 is a screenshot of a TGT request by a high-privileged user with the account name and client address highlighted.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/12/word-image-33.png) Figure 6. TGS request by high-privileged user. ### Diamond Ticket #### Generating a Ticket for Domain Admin Account The detection here is pretty similar to any Golden Ticket detector or the suggested Sapphire Ticket detector. #### Elevating Normal Domain User's Privileges If the adversary uses this technique, it will look like legitimate authentication. The TGT and TGS requests will be for the same user, and the suggested detectors won't be relevant. This activity can be monitored by looking for anomalies in both the number of resources being accessed and what resources the user accessed. Attackers will likely be accessing high-privileged resources, so this activity will be new. Anomaly detection can be tricky in big environments and can cause distraction rather than finding an attack. It's important to note that the main difference between Diamond Ticket and Sapphire Ticket is that a Sapphire Ticket has an actual PAC of a real high-privileged user. In Diamond Ticket and Golden Ticket attacks, the PAC is modified by the attacker, and might therefore be inaccurate. This information can be used to detect these attacks. ### Group Membership Detection To make this detection method more approachable, let me introduce you to [Windows event 4627(S): Group membership information](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4627). This event is generated with Windows event "4624(S): An account was successfully logged on," and it shows the list of groups that the logged-on account belongs to. ![Image 7 is a screenshot of Windows Event 4627. The window title is "Event Properties - Event 4627, Microsoft Windows security auditing."](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/12/word-image-34.png) Figure 7. Windows Event 4627. *Source* - [Microsoft](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4627) This requires OS Version Windows Server 2016, Windows 10 and above. To enable it, you must enable the Success Audit for the [Audit Logon](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-logon) subcategory. Monitoring this event will allow you to discover irregularities in the user's group memberships. When an attacker wants to assign domain admin privileges to a forged ticket, they add the domain admin rid (512) to the PAC. Thus, during the login, it appears the user is part of the domain admins. An example of this would be using Diamond Ticket attacks to elevate a low-privileged user (we'll continue to use "Joe") to domain admin privileges, as shown in Figures 8 and 9. ![Image 8 is a screenshot of how low-privileged users appear in Windows Event 4627. Highlighted is Joe's name along with Joe's membership access as a domain admin.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/12/word-image-35.png) Figure 8. Low-privileged user appears in domain admin. ![Image 9 is a screenshot of the Domain Admins Properties window showing that Joe is not a member listed in the Members tab.](https://unit42.paloaltonetworks.com/wp-content/uploads/2022/12/word-image-36.png) Figure 9. Joe is not a member of domain admins. It is worth noting that, if an adversary impersonates a high-privileged user using a forged TGT, they might assign the wrong group membership. Therefore, it is worth paying attention to those as well. To avoid false positives (when a user is intentionally added to a high-privileged group), event 4627 can be correlated with Windows events [4732](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4732) and [4728](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728), which indicate when a user is added to a group. ## Conclusion In this blog, after a brief primer on relevant Kerberos terms and the attacks themselves, we discussed the privileges required to perform such attacks and the importance of monitoring different forged ticket attacks. Additionally, we examined possible detection ideas that might help cover Golden Ticket attacks as well as new attack methods. Forged ticket attacks might be hard to detect with a cursory glance, since they can initially appear to be legitimate. However, if enough information is collected about suspicious network activity, malicious tool usage, or Windows events, we might be able to detect some of the most effective Kerberos attacks. In addition, deploying a security platform such as [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) can provide an additional layer of protection and visibility to the various stages of the attack. ## Additional Resources [Detecting and Preventing the Path to a Golden Ticket With Cortex XDR](https://www.paloaltonetworks.com/blog/security-operations/detecting-and-preventing-the-path-to-a-golden-ticket-with-cortex-xdr/) - Palo Alto Networks [Protecting Against the Bronze Bit Vulnerability with Cortex XDR](https://www.paloaltonetworks.com/blog/security-operations/bronze-bit-vulnerability-xdr/) - Palo Alto Networks [The Essential Guide to XDR](https://start.paloaltonetworks.com/essential-guide-to-xdr.html) - Palo Alto Networks [Understanding Microsoft Kerberos PAC Validation](https://learn.microsoft.com/en-us/archive/blogs/openspecification/understanding-microsoft-kerberos-pac-validation) - Microsoft [The Kerberos Network Authentication Service (V5)](https://www.rfc-editor.org/rfc/rfc4120) - MIT [A Diamond (Ticket) in the Ruff](https://www.semperis.com/blog/a-diamond-ticket-in-the-ruff/) - Semperis ## Appendix: Glossary [**Constrained delegation**](https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-constrained-delegation-overview) -- Provides a safer form of delegation that could be used by services. When it is configured, constrained delegation restricts the services to which the specified server can act on the behalf of a user. **DCSync Attack** -- Abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller. **Domain controller (DC)** -- A server computer that responds to security authentication requests within a computer network domain. It is a network server that is responsible for allowing host access to domain resources. Serves as the KDC in AD environments. **ENC-TKT-IN-SKEY** -- The option indicates that the ticket for the end server is to be encrypted in the session key from the additional TGT provided. **Golden Ticket attack** -- Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT) called "Golden ticket" which enable adversaries to generate authentication material for any account in Active Directory. **Kerberos** -- Kerberos is a network authentication protocol that is primarily used in Active Directory environments. [**Kerberos delegation**](https://learn.microsoft.com/en-us/defender-for-identity/security-assessment-unconstrained-kerberos) -- Kerberos delegation is a delegation setting that allows applications to request end-user access credentials to access resources on behalf of the originating user. **Key Distribution Center (KDC)** -- A key distribution center (KDC) in cryptography is a system that is responsible for providing keys to the users in a network that shares sensitive or private data. **KRBTGT account** -- A local default account that acts as a service account for the KDC service. **PA-FOR-USER** -- A struct used to identify the user, on whose behalf the service requests the service ticket, using the user name and user realm. **Privileged Attribute Certificate (PAC)** -- The PAC is a structure that conveys authorization-related information provided by domain controllers (DCs). The PAC is used by authentication protocols that verify identities to transport authorization information, which controls access to resources. **S4U** -- Kerberos extensions in order to avoid keeping the user's TGT in memory. It consists of S4U2Self and S4U2Proxy. **S4U2Proxy** -- Will allow a service to authenticate to a different service. **S4U2Self** -- Allows a service to ask for a ticket to itself on behalf of any user. **Service Principal Names (SPN)** -- A unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. **Ticket Granting Server (TGS)** -- A TGS validates the use of a ticket for a specified purpose, such as network service access. **Ticket Granting Ticket (TGT)** -- A user authentication token issued by the KDC that is used to request access tokens from the Ticket Granting Service (TGS) for specific resources/systems joined to the domain. **U2U authentication** -- A method to perform authentication when the verifier does not have access to a long-term service key. To address this problem, the Kerberos protocol allows the client to request that the ticket issued by the KDC be encrypted using a session key from a TGT issued to the party that will verify the authentication. *Updated December 13, 2022, at 8:25 a.m. PT.* Back to top ### Tags * [Diamond Ticket](https://unit42.paloaltonetworks.com/tag/diamond-ticket/ "Diamond Ticket") * [Golden Ticket](https://unit42.paloaltonetworks.com/tag/golden-ticket/ "Golden Ticket") * [Kerberos](https://unit42.paloaltonetworks.com/tag/kerberos/ "kerberos") * [Privilege escalation](https://unit42.paloaltonetworks.com/tag/privilege-escalation/ "privilege escalation") * [Sapphire Ticket](https://unit42.paloaltonetworks.com/tag/sapphire-ticket/ "Sapphire Ticket") [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Compromised Cloud Compute Credentials: Case Studies From the Wild](https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/ "Compromised Cloud Compute Credentials: Case Studies From the Wild") ### Table of Contents * ### Related Articles * [Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy](https://unit42.paloaltonetworks.com/siemens-rox-ii-zero-day-vulnerabilities/ "article - table of contents") * [The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ "article - table of contents") * [Cracks in the Bedrock: Agent God Mode](https://unit42.paloaltonetworks.com/exploit-of-aws-agentcore-iam-god-mode/ "article - table of contents") ## Related Cloud Cybersecurity Research Resources ![Pictorial representation of how AWS neutralizes compromised IAM credentials. Digital illustration of a glowing cloud composed of binary code, surrounded by dynamic red and blue light streaks, symbolizing cloud computing technology.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 21, 2026 [#### From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies](https://unit42.paloaltonetworks.com/detecting-exposed-aws-iam-credentials/) * [AWS](https://unit42.paloaltonetworks.com/tag/aws/ "AWS") * [AWS CloudTrail](https://unit42.paloaltonetworks.com/tag/aws-cloudtrail/ "AWS CloudTrail") * [Bedrock](https://unit42.paloaltonetworks.com/tag/bedrock/ "bedrock") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/detecting-exposed-aws-iam-credentials/ "From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies") ![Pictorial representation of how default AWS AgentCore Harness configurations allow prompt injection to exfiltrate AgentCore Identity credentials. Futuristic illustration with glowing neon lights and advanced technology motifs, depicting cloud computing and data flow through interconnected networks. The scene is highlighted by hovering digital clouds and dynamic, illuminated linear structures, set in a dramatic, blue and orange color scheme.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/03_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 18, 2026 [#### A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity](https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/) * [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI") * [AWS](https://unit42.paloaltonetworks.com/tag/aws/ "AWS") * [Cloud](https://unit42.paloaltonetworks.com/tag/cloud/ "Cloud") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/securing-aws-agentcore-harness-credentials/ "A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity") ![Pictorial representation of automated detection. Digital illustration of a glowing blue brain connected to a network of lines and lights.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Cloud_cybersecurity_research_Overview_1920x900-2-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 14, 2026 [#### Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection](https://unit42.paloaltonetworks.com/behavioral-clustering-map-to-cloud-identities/) * [AWS CloudTrail](https://unit42.paloaltonetworks.com/tag/aws-cloudtrail/ "AWS CloudTrail") * [Cloud detection](https://unit42.paloaltonetworks.com/tag/cloud-detection/ "cloud detection") * [DevOps](https://unit42.paloaltonetworks.com/tag/devops/ "DevOps") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/behavioral-clustering-map-to-cloud-identities/ "Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection") ![Pictorial representation of bucket hijacking technique for cloud data exfiltration. Digital illustration of Europe map highlighting network connections and nodes, depicted as glowing points and lines on a dark blue background, emphasizing major cities and connectivity across the continent.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/09_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 22, 2026 [#### The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/) * [AWS](https://unit42.paloaltonetworks.com/tag/aws/ "AWS") * [Bucket hijacking](https://unit42.paloaltonetworks.com/tag/bucket-hijacking/ "bucket hijacking") * [Cloud data exfiltration](https://unit42.paloaltonetworks.com/tag/cloud-data-exfiltration/ "cloud data exfiltration") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-bucket-hijacking-risks/ "The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration") ![Pictorial representation of Vertex AI model uploads. Close-up view of a digital wall displaying various glowing icons, representing a high-tech network interface.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/AdobeStock_1270203474-1-786x354.png) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 16, 2026 [#### Pickle in the Middle -- Hijacking Vertex AI Model Uploads for Cross-Tenant RCE](https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/) * [Bucket squatting](https://unit42.paloaltonetworks.com/tag/bucket-squatting/ "bucket squatting") * [Google Cloud](https://unit42.paloaltonetworks.com/tag/google-cloud/ "Google Cloud") * [Joblib](https://unit42.paloaltonetworks.com/tag/joblib/ "joblib") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/ "Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE") ![Pictorial representation of Cloud Logging services for defense evasion. A vibrant digital illustration depicting a glowing, neon blue cloud symbol positioned over a circuit board landscape. The cloud symbolizes cloud computing technology, and the landscape features intricate electronic circuits with glowing lines and nodes, suggesting high-tech data transfer and connectivity.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/06/11_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) June 9, 2026 [#### Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility](https://unit42.paloaltonetworks.com/cloud-logging-defense-evasion/) * [AWS CloudTrail](https://unit42.paloaltonetworks.com/tag/aws-cloudtrail/ "AWS CloudTrail") * [Cloud logging](https://unit42.paloaltonetworks.com/tag/cloud-logging/ "cloud logging") * [Defense evasion](https://unit42.paloaltonetworks.com/tag/defense-evasion/ "defense evasion") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/cloud-logging-defense-evasion/ "Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility") ![Pictorial representation of ROADtools framework in the cloud. An Asian man wearing glasses sits in front of a computer screen. Reflecting in the glasses are lines indicating analysis. Bright blue city lights illuminate the rest of the image.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/05/10_Cloud_cybersecurity_research_Overview_1920x900-1-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) May 22, 2026 [#### Paved With Intent: ROADtools and Nation-State Tactics in the Cloud](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/) * [Curious Serpens](https://unit42.paloaltonetworks.com/tag/curious-serpens/ "Curious Serpens") * [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID") * [Microsoft Azure](https://unit42.paloaltonetworks.com/tag/microsoft-azure/ "Microsoft Azure") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/ "Paved With Intent: ROADtools and Nation-State Tactics in the Cloud") ![Pictorial representation of autonomous AI attack in cloud environments. Digital illustration of a glowing blue brain connected to a network of lines and lights.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/04/12_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) April 23, 2026 [#### Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System](https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/) * [AI](https://unit42.paloaltonetworks.com/tag/ai/ "AI") * [Cloud](https://unit42.paloaltonetworks.com/tag/cloud/ "Cloud") * [Data exfiltration](https://unit42.paloaltonetworks.com/tag/data-exfiltration/ "data exfiltration") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/ "Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System") ![Pictorial representation of passwordless authentication. Futuristic cityscape with skyscrapers surrounded by glowing, neon-lit pathways and digital clouds. The sky is vibrant with pink and orange hues, giving a surreal, cyberpunk aesthetic.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/02_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) March 23, 2026 [#### Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication](https://unit42.paloaltonetworks.com/passwordless-authentication/) * [Google](https://unit42.paloaltonetworks.com/tag/google/ "Google") * [Google authenticator](https://unit42.paloaltonetworks.com/tag/google-authenticator/ "google authenticator") * [Google Chrome](https://unit42.paloaltonetworks.com/tag/google-chrome/ "Google Chrome") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/passwordless-authentication/ "Google Cloud Authenticator: The Hidden Mechanisms of Passwordless Authentication") ![Close-up of a black woman with glasses examining colorful computer code on a screen. The scene is illuminated by various lights, creating a focused and analytical atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/02/13_Cloud_cybersecurity_research_Overview_1920x900-786x368.jpg) [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) February 6, 2026 [#### Novel Technique to Detect Cloud Threat Actor Operations](https://unit42.paloaltonetworks.com/tracking-threat-groups-through-cloud-logging/) * [API](https://unit42.paloaltonetworks.com/tag/api/ "API") * [IAM](https://unit42.paloaltonetworks.com/tag/iam/ "IAM") * [MITRE](https://unit42.paloaltonetworks.com/tag/mitre/ "MITRE") [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/tracking-threat-groups-through-cloud-logging/ "Novel Technique to Detect Cloud Threat Actor Operations") * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) * ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]() ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png) ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42 ## Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement") This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. Invalid captcha! Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg) {#footer} Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security) * [Secure AI by Design](https://www.paloaltonetworks.com/ai-security) * [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase) * [Prisma SASE](https://www.paloaltonetworks.com/sase) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) * [Prisma Access](https://www.paloaltonetworks.com/sase/access) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam) * [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira) * [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management) * [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management) * [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager) * [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance) * [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management) * [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic) * [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management) * [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance) * [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery) * [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42) * [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense) * [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses) * [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy) * [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence) * [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond) Company * [About Us](https://www.paloaltonetworks.com/about-us) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility) * [Customers](https://www.paloaltonetworks.com/customers) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom) Popular Links * [Blog](https://www.paloaltonetworks.com/blog/) * [Communities](https://www.paloaltonetworks.com/communities) * [Content Library](https://www.paloaltonetworks.com/resources) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure) * [Sitemap](https://www.paloaltonetworks.com/sitemap) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use) * [Documents](https://www.paloaltonetworks.com/legal) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ### Default Heading Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) Seekbar ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg) Volume ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)