kerberos golden silver diamond sapphire ticket detector — free browser tool | fatcousin

drop event log + sysmon + zeek kerberos · detect all four ticket abuse classes

input

drop security evtx csv · sysmon · zeek kerberos.log

4768/4769/4624 · KeyCredentialLink · multi-source correlation

Select file

golden (krbtgt TGT / 10h lifetime) · silver (forged service ticket) · diamond (KeyCredentialLink) · sapphire (delegation/S4U2Self)

limits

heuristic screener · multi-source correlation only · extends kerberos-traffic-analyzer patterns · not definitive proof

status

>ready