CmdID / Techniques / T1550

T1550.003 Use Alternate Authentication Material: Pass the Ticket

Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. MITRE ATT&CK

2 Sigma rules T1550.003 on attack.mitre.org