Golden & Silver Ticket Persistence

You have achieved Domain Admin access during an authorized penetration test. Reason through Kerberos ticket forgery for long-term persistence.

**Golden Ticket**
- What is a Golden Ticket and what does it allow you to do?
- What do you need to create a Golden Ticket? (KRBTGT hash, domain SID, domain name)
- How long does a Golden Ticket remain valid after a KRBTGT password rotation?
- Why do defenders need to rotate the KRBTGT account password TWICE to invalidate existing tickets?

**Silver Ticket**
- What is a Silver Ticket and how does it differ from a Golden Ticket?
- What service account hash do you need for a Silver Ticket targeting CIFS vs HTTP vs MSSQLSvc?
- Why is a Silver Ticket harder to detect than a Golden Ticket?

**Diamond & Sapphire Tickets**
- What makes Diamond and Sapphire Tickets more evasive than Golden Tickets?
- How does a Diamond Ticket modify a legitimately issued TGT vs create one from scratch?

**Operational Considerations**
- How do you pass a forged ticket into your current session on Windows?
- How do you use a forged ticket with Linux tooling? (impacket ticketer)
- What event log IDs should defenders monitor for ticket anomalies?

**Persistence Value**
- Why is a Golden Ticket considered "persistent" even though it is a ticket, not a backdoor?
- How does Golden Ticket persistence survive password changes?
- What is the only reliable way for defenders to invalidate an existing Golden Ticket?

Output:
- Golden vs. Silver vs. Diamond Ticket comparison table
- Creation commands for each (Mimikatz + impacket)
- Defender detection events and mitigation