MELTr
Home Vendors Search Download
Login
Vendors / Microsoft Corporation / Defender for Identity / Pass-the-Ticket Attack Detection
Microsoft Corporation logo

Event type

Pass-the-Ticket Attack Detection

Defender for Identity lateral movement alert

Microsoft Defender for Identity alert for pass-the-ticket attacks indicating lateral movement through stolen Kerberos tickets

JSON 24 fields Low Generator

defender identity kerberos lateral-movement pass-the-ticket mitre-t1550 critical-alert
Preview Sample View Schema
CLI Install
meltr templates install microsoft

Overview

What this event covers

Detects pass-the-ticket attacks where attackers steal Kerberos tickets from one machine and use them on another to move laterally through the network. This is a critical indicator of advanced persistent threats and Active Directory compromise.

When generated

  • ›When stolen Kerberos tickets are detected being used from different machines
  • ›During lateral movement activities in compromised environments
  • ›When attackers attempt to escalate privileges using stolen credentials
  • ›As part of advanced persistent threat (APT) campaigns

Security relevance

Critical

Compliance

NIST Cybersecurity Framework MITRE ATT&CK Framework SOC 2 ISO 27001 PCI DSS

Frequency notes

Very rare in legitimate environments (0.5 events/hour baseline). Higher frequency during off-hours suggests active compromise. Most alerts should be investigated as potential true positives.

Resources

Docs and tools

Microsoft Defender for Identity Documentation official Pass-the-Ticket Attack Detection official MITRE ATT&CK T1550.003: Pass the Ticket reference Microsoft 365 Defender Portal Unified security portal for investigating and responding to Defender for Identity alerts Microsoft Defender for Identity Portal Dedicated portal for Defender for Identity management and investigation Azure Active Directory Identity Protection Complementary identity security service for user risk assessment

Generation

Configuration

Base frequency
0.5 events/hour
Time patterns
business_hours night_hours weekend
Business hours
1.5x
Night hours
2.0x
Weekend
0.8x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

alertId
String Required

Unique identifier for the alert with 'a' prefix

Source: 'a' + random_guid()

Format a{UUID}
Example aa1b2c3d4-e5f6-7890-abcd-ef1234567890
providerAlertId
String Required

Provider-specific alert identifier (typically same as alertId without prefix)

Source: random_guid()

Format UUID
Example a1b2c3d4-e5f6-7890-abcd-ef1234567890
incidentId
Integer Required

Incident number for tracking and correlation

Source: random_int(100, 9999)

Example 1234
serviceSource
String Required

Microsoft service that generated the alert

Source: Fixed value

Example MicrosoftDefenderForIdentity
creationTime
DateTime Required

UTC timestamp when the alert was created

Source: current_timestamp()

Format ISO 8601 with milliseconds
Example 2024-01-15T14:30:25.123Z
lastUpdatedTime
DateTime Required

UTC timestamp when the alert was last updated

Source: creationTime + random hours

Format ISO 8601 with milliseconds
Example 2024-01-15T15:45:30.456Z
resolvedTime
DateTime Optional

UTC timestamp when the alert was resolved (if resolved)

Source: lastUpdatedTime - random minutes

Format ISO 8601 with milliseconds
Example 2024-01-15T16:15:45.789Z
firstActivity
DateTime Required

UTC timestamp of the first suspicious activity

Source: creationTime - random hours

Format ISO 8601 with milliseconds
Example 2024-01-15T12:15:30.123Z
lastActivity
DateTime Required

UTC timestamp of the last suspicious activity

Source: firstActivity + random minutes

Format ISO 8601 with milliseconds
Example 2024-01-15T12:45:30.456Z
title
String Required

Human-readable alert title

Source: Fixed descriptive title

Example Suspected identity theft (pass-the-ticket)
description
String Required

Detailed description of the detected activity

Source: Dynamic description with user, devices, and resource count

Example An actor took John Doe (Manager)'s Kerberos ticket from WORKSTATION01 and used it on SERVER02 to access 3 resources.
category
String Required

MITRE ATT&CK tactic category

Source: Fixed value for pass-the-ticket attacks

Example LateralMovement
Values
  • LateralMovement MITRE ATT&CK Lateral Movement tactic
status
String Required

Current status of the alert investigation

Source: Random from predefined statuses

Example Resolved
Values
  • New Newly created alert awaiting investigation
  • InProgress Alert currently under investigation
  • Resolved Alert investigation completed
severity
String Required

Severity level of the security alert

Source: Random from severity levels

Example High
Values
  • Low Low severity security event
  • Medium Medium severity security event
  • High High severity security event
  • Critical Critical security event requiring immediate attention
investigationId
String Optional

Investigation tracking identifier (often null for unsupported alert types)

Source: Fixed null value

Example null
investigationState
String Required

State of the automated investigation

Source: Fixed value indicating manual investigation required

Example UnsupportedAlertType
classification
String Required

Alert classification after investigation

Source: Random from classification options

Example TruePositive
Values
  • Unknown Classification not yet determined
  • FalsePositive Alert determined to be benign
  • TruePositive Alert confirmed as malicious activity
  • BenignPositive Alert is accurate but represents benign activity
determination
String Required

Specific determination of the alert cause

Source: Random from determination options

Example SecurityTesting
Values
  • NotAvailable Determination not available
  • Apt Advanced Persistent Threat activity
  • Malware Malware-related activity
  • SecurityPersonnel Authorized security personnel activity
  • SecurityTesting Authorized security testing
  • UnwantedSoftware Unwanted but not malicious software
  • Other Other determination
detectionSource
String Required

Source system that detected the threat

Source: Fixed legacy identifier for Defender for Identity

Example AzureATP
detectorId
String Required

Specific detector that triggered the alert

Source: Fixed detector identifier

Example PassTheTicketSecurityAlert
assignedTo
String Optional

Email address of the assigned investigator

Source: Random user email from registry

Format Email
Example security.analyst@contoso.com
mitreTechniques
Array Required

MITRE ATT&CK technique identifiers

Source: Fixed array for pass-the-ticket techniques

Example ["T1550", "T1550.003"]
devices
Array Required

Array of device objects involved in the alert

Source: Array of 3 devices with detailed metadata

Example [{"mdatpDeviceId": "abc123", "deviceDnsName": "server01.contoso.com"}]
entities
Array Required

Array of security entities involved in the alert (users, IPs, etc.)

Source: Array containing krbtgt account, target user, and source IP

Example [{"entityType": "User", "accountName": "jdoe", "verdict": "Suspicious"}]