saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/conducting-pass-the-ticket-attack/references/api-reference.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

1.6 KiB
Raw Blame History

Pass-the-Ticket Detection — API Reference

Libraries

Library Install Purpose
impacket pip install impacket Kerberos ticket manipulation (ticketer.py, getST.py)
ldap3 pip install ldap3 AD LDAP queries for SPN and account enumeration
pySigma pip install pySigma Sigma rule parsing and conversion

Key Windows Event IDs

Event ID Description Relevance
4768 Kerberos TGT request Golden ticket detection (RC4 = 0x17)
4769 Kerberos service ticket request Silver ticket / Kerberoasting
4770 Kerberos service ticket renewed Ticket reuse indicator
4771 Kerberos pre-auth failed Password spray detection
4624 Successful logon Correlate with ticket usage

Encryption Type Constants

Value Algorithm Concern
0x17 RC4-HMAC Downgrade attack indicator
0x12 AES-256 Expected modern encryption
0x11 AES-128 Acceptable encryption

MITRE ATT&CK Mapping

Technique ID
Use Alternate Authentication Material: Pass the Ticket T1550.003
Steal or Forge Kerberos Tickets: Golden Ticket T1558.001
Steal or Forge Kerberos Tickets: Silver Ticket T1558.002

External References