Detect Golden Ticket attacks in Active Directory using Splunk and KQL queries against domain controller event logs, looking for Kerberos TGT anomalies such as mismatched encryption types, impossible ticket lifetimes, non-existent accounts, and forged PAC signatures. Use when hunting for Kerberos ticket forgery or krbtgt-based persistence (MITRE T1558.001) in AD environments.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-golden-ticket-attacks-in-kerberos-logsnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-golden-ticket-attacks-in-kerberos-logs -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-golden-ticket-attacks-in-kerberos-logs -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-golden-ticket-attacks-in-kerberos-logsgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-golden-ticket-attacks-in-kerberos-logsgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-golden-ticket-attacks-in-kerberos-logs ~/.claude/skills/detecting-golden-ticket-attacks-in-kerberos-logs # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-golden-ticket-attacks-in-kerberos-logs ~/.agents/skills/detecting-golden-ticket-attacks-in-kerberos-logs # Codex, Cursor, Gemini CLI, Copilot, OpenCode