Kerberos Pass-the-Ticket: TGS with Forged PAC

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects Kerberos Pass-the-Ticket attacks where a Ticket Granting Service (TGS) request contains a forged Privilege Attribute Certificate (PAC). This is identified by specific byte sequences in UDP traffic on port 88, which is commonly used for Kerberos.