Skip to content
Get packs

Pass-the-Ticket Attack Playbook

Guides red teamers through Kerberos ticket theft and reuse for authorized lateral-movement testing

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

This skill gives an AI agent a structured playbook for Pass-the-Ticket, a technique attackers use to move between computers on a Windows network by reusing stolen Kerberos login tickets instead of passwords. It walks through extracting tickets from a compromised machine's memory, loading them into another session, and documenting the access, and it includes a script that scans Windows Security event logs for signs of this kind of ticket abuse. It is intended for authorized security testing and detection validation, not for real attacks.

Great for

  • Red teams running authorized post-exploitation exercises in a lab or contracted engagement
  • Blue teams validating whether Kerberos ticket theft and reuse is detected in their logs
  • Security engineers writing or tuning detections for Event IDs 4768 and 4769

Skip it if

  • Use against systems you do not own or lack written permission to test, which is illegal and harmful
  • Beginners hoping to learn Kerberos security from scratch, since the skill assumes red-team background and offers little explanation
  • Environments needing a fully verified tool: the script generates commands and text rather than fully automating an attack, and its contents were only partly reviewed

Try asking

  • “Walk me through an authorized pass-the-ticket test against our lab domain and document the evidence”
  • “Write a detection rule for RC4 Kerberos ticket requests in our Windows event logs”
  • “Convert a .kirbi ticket to ccache format for use with Impacket in our test environment”
  • “Scan this exported Security event log JSON for suspicious 4768 and 4769 events”
Step-by-step guide: how to use Pass-the-Ticket Attack PlaybookInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    conducting-pass-the-ticket-attack.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip conducting-pass-the-ticket-attack.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip conducting-pass-the-ticket-attack.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Confirm written authorization and a lab scope before any extraction step; the skill's own legal notice requires this
  • Use the detection script on exported logs first to test your monitoring before running offensive steps
  • Review scripts/process.py and agent.py yourself before running them, since they were only partly visible in this assessment

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.