Activity timeline
T1550.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-11.
How adversaries use it
T1550.003 Pass the Ticket is catalogued by MITRE ATT&CK under the Lateral Movement tactic in the Enterprise matrix, as a sub-technique of T1550 Use Alternate Authentication Material. Threadlinqs maps 10 of 3487 tracked threats (0.3%) to it; by severity that is 3 critical, 6 high, 1 medium.
Threats that use T1550.003 most often also use T1087.002 Domain Account (7 threats), T1098 Account Manipulation (6 threats), T1018 Remote System Discovery (5 threats), T1021.002 SMB/Windows Admin Shares (5 threats), T1078.002 Domain Accounts (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
6 tracked threat actors appear in the threats that use T1550.003; the most frequent are Akira (1), Cavern Manticore (1), MuddyWater (1), Storm-0940 (1), Storm-1567 (1).
Mitigations
MITRE ATT&CK lists 4 mitigations for T1550.003.
Data sources
Telemetry that can reveal T1550.003, per MITRE ATT&CK.
- Active Directory — Active Directory Credential Request
- Logon Session — Logon Session Creation
- User Account — User Account Authentication
Threat actors using it
Tracked threats
10 tracked threats use T1550.003.
- ARTEX Autonomous AI Pentest Framework Weaponized by UNC7228 / Storm-0940 for Automated Network Intrusions…high
- Windows Authentication Reflection Mitigation Bypasses for SYSTEM Shells via Kerberos Unicode Coercion…high
- Cross-Domain & Cross-Forest Resource-Based Constrained Delegation (RBCD) Abuse in Active Directorymedium
- Ghost SPN: Active Directory SPN Misconfigurations Enable Stealthy Kerberoastinghigh
- CVE-2026-54121 ("Certighost"): Low-Privileged AD CS Enrollment Flaw Enables Domain Controller Impersonationcritical
- HOLLOWGRAPH: .NET NativeAOT Malware Abusing Microsoft Graph API and M365 Calendar Events for C2, Linked to…high
- SonicWall SMA1000 Zero-Days CVE-2026-15409 (Unauthenticated SSRF, CVSS 10.0) and CVE-2026-15410 (Post-Auth…critical
- Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow…high
- Seedworm (MuddyWater) Q1 2026 Global Espionage Campaign — DLL Sideloading via Signed Fortemedia and…high
- AI-Augmented FortiGate Mass Exploitation — Russian-Speaking Actor Breaches 600+ Firewalls Across 55…critical
Detection coverage
Threadlinqs maintains 22 detection rules mapped to T1550.003 (SPL 8, KQL 7, Sigma 7). Rule content unlocks with TL Creds on a free account; this page shows counts only.
Parent technique
T1550 Use Alternate Authentication Material — 213 tracked threats at the technique level.