ATT&CK technique
View on MITRE ATT&CK →
T1550.003
Pass the Ticket
Lateral Movement
12 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Suspicious Kerberos Authentication Ticket Request | production | 2026-09-18 |
| elastic | Kerberos Traffic from Unusual Process | production | 2026-09-18 |
| elastic | Potential Kerberos Attack via Bifrost | production | 2026-09-18 |
| elastic | Potential Invoke-Mimikatz PowerShell Script | production | 2026-09-18 |
| splunk | Rubeus Kerberos Ticket Exports Through Winlogon Access | production | 2026-09-08 |
| splunk | Windows Process With NetExec Command Line Parameters | production | 2026-05-13 |
| splunk | Mimikatz PassTheTicket CommandLine Parameters | production | 2026-05-13 |
| splunk | Rubeus Command Line Parameters | production | 2026-05-13 |
| sigma | Uncommon Outbound Kerberos Connection | test | 2024-03-15 |
| sigma | HackTool - Rubeus Execution - ScriptBlock | test | 2023-04-27 |
| sigma | HackTool - Rubeus Execution | stable | 2023-04-20 |
| sigma | HackTool - KrbRelayUp Execution | test | 2023-02-04 |