Diamond Ticket

A Diamond Ticket is a Kerberos ticket-manipulation procedure that starts with a genuine TGT issued for a valid domain account, then decrypts that ticket with the domain KRBTGT key, modifies and re-signs its PAC, and re-encrypts the TGT. The PAC can add privileged group membership to the same account or change the represented identity. The modified TGT is presented to the KDC to request service tickets and then used against a target service. Because the initial TGT was genuinely issued, Event 4768 is expected; the missing-4768 analytic for offline Golden Tickets does not reliably detect the same-user PAC-modification case. A successful TGS request alone does not prove access to the target service.