Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns, with detection queries for Splunk and Elastic SIEM. Use when investigating incidents involving stolen or replayed Kerberos tickets, building detection rules or threat hunting queries for ticket abuse, or validating SOC monitoring coverage for credential-theft…
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-pass-the-ticket-attacksnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-pass-the-ticket-attacks -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-pass-the-ticket-attacks -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-pass-the-ticket-attacksgh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-pass-the-ticket-attacksgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-pass-the-ticket-attacks ~/.claude/skills/detecting-pass-the-ticket-attacks # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-pass-the-ticket-attacks ~/.agents/skills/detecting-pass-the-ticket-attacks # Codex, Cursor, Gemini CLI, Copilot, OpenCode