Detect Kerberos Golden Ticket forgery (e.g. Mimikatz-forged tickets) by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies using Splunk and Elastic SIEM queries. Use when investigating suspected forged Kerberos tickets or krbtgt credential theft in Active Directory.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-golden-ticket-forgerynpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-golden-ticket-forgery -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-golden-ticket-forgery -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-golden-ticket-forgerygh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-golden-ticket-forgerygit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-golden-ticket-forgery ~/.claude/skills/detecting-golden-ticket-forgery # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-golden-ticket-forgery ~/.agents/skills/detecting-golden-ticket-forgery # Codex, Cursor, Gemini CLI, Copilot, OpenCode