Skip to content
Get packs

Guide · Agent skill

How to use the Pass-the-Ticket Attack Playbook agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The Pass-the-Ticket Attack Playbook is an agent skill, a folder of instructions and scripts that an AI agent such as Claude can load when a task matches it. It covers Pass-the-Ticket (PtT), a technique where stolen Kerberos login tickets are reused to reach other Windows machines without the password. After this guide you will know how to install the skill, how to ask for it in plain language, what it needs, and what safety limits to respect.

Pass-the-Ticket Attack Playbookmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Confirm you are authorized. Get written permission and a defined scope for the lab or engagement. The skill is for authorized testing only.
  2. 2Set up Python and packages. Install Python 3.8 or newer, then install the pip packages rich and impacket.
  3. 3Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
  4. 4Ask for the task in plain language. Describe the goal and scope, such as validating detection on a lab host or reviewing an exported log.
  5. 5Provide inputs. For log review, supply a Windows Security event log exported as JSON. For the attack workflow, confirm you have local admin on a test host and Mimikatz or Rubeus available.
  6. 6Review the output. Check any commands or text the agent produces against the source before running them.
  7. 7Document the results. Fill in the report template and record evidence for each validation criterion.

What does the skill make the agent do?

Pass-the-Ticket is a lateral movement technique. An attacker with local admin on one Windows host extracts Kerberos TGT or TGS tickets from LSASS memory, then loads them into another session so they can act as the ticket owner without knowing that person's password. The skill gives the agent a structured playbook for this in three phases: ticket extraction, ticket injection and lateral movement, with a checklist for documenting the results.

It is written for authorized post-exploitation work and for checking whether defenders can see this activity. Alongside the playbook it includes a report template and a script that scans exported Windows Security event logs for signs of ticket abuse.

  • Playbook phases: ticket extraction, ticket injection, lateral movement
  • Reference material on Kerberos ticket types, Windows Event IDs and MITRE ATT&CK mapping
  • A report template for ticket extraction, ticket details, lateral movement results and recommendations
  • A script (agent.py) that works on Windows Security event logs exported as JSON

How do you install the skill?

Download the skill ZIP from this page and unzip it into one of two locations. For a personal install, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project. The skill folder contains SKILL.md, which the agent reads first.

If you use the Claude apps instead of Claude Code, upload the ZIP under Settings → Capabilities → Skills.

  • Personal install: unzip into ~/.claude/skills/
  • Project install: unzip into the project's .claude/skills/ folder
  • Claude apps: upload the ZIP under Settings → Capabilities → Skills

What do you need before using it?

The skill assumes a red-team background. It explains little about Kerberos itself, so beginners should learn the basics first. The source lists these requirements.

The attack workflow needs local admin on a test Windows host. Mimikatz or Rubeus is needed for ticket extraction, but the skill references these tools without including them. The scripts need Python 3.8 or newer and the pip packages rich and impacket.

  • Python 3.8+
  • pip packages: rich and impacket (install with pip install impacket and pip install rich)
  • Mimikatz or Rubeus for ticket extraction (referenced, not included)
  • Local admin access on a test Windows host for the attack workflow
  • A Windows Security event log exported as JSON for agent.py

How do you trigger the skill with natural requests?

You do not need a special command. Describe the task in plain language that matches the skill's description, and mention that the work is authorized. Name the goal you want, such as validating detection or reviewing logs, so the agent chooses the right workflow.

Good requests name the scope and the output you want, for example a list of Event IDs to check or a findings summary for a report.

  • "Using the Pass-the-Ticket playbook, walk me through an authorized test on our lab host and fill in the report template."
  • "Check this exported Windows Security JSON log for signs of Kerberos ticket reuse."
  • "Help me write detection logic for Event ID 4768 and 4769 anomalies where a ticket is used from a different IP than it was issued to."
  • "Summarize the validation criteria we still need to evidence for our Pass-the-Ticket exercise."

What does the detection side look at?

For defenders, the most useful part is the detection indicators. The skill points to Windows Event ID 4768 (TGT requests) and 4769 (service ticket requests), and to patterns such as a TGT used from a different IP than it was issued to, service ticket requests from unexpected hosts, and one ticket authenticating across several workstations.

The reference material also lists Event ID 4624 (successful logon) for correlating ticket use with logons, and 4770 as a ticket reuse indicator. The report template recommends hardening steps such as Credential Guard, the Protected Users group, LSASS RunAsPPL and shorter TGT lifetimes for admin accounts.

  • Event 4768: unusual client addresses for a TGT request
  • Event 4769: service ticket requests from unexpected hosts
  • Mismatched IP between a TGT's issue and its use
  • One ticket used across multiple workstations
  • Related: 4624 logons and 4770 renewals for correlation

Safety notes: scripts and network use

The skill runs scripts. The source says it does not use the network. Review the scripts before running them, and run them only on systems you control. The source notes that its script generates commands and text rather than fully automating an attack, and that its contents were only partly reviewed, so verify outputs yourself.

Use the skill only against systems you own or have written permission to test. The skill's own legal notice states that unauthorized use is illegal and may violate computer fraud laws.

  • Runs scripts: yes. Read them before running.
  • Uses network: no, according to the source.
  • Only partly reviewed; check outputs before relying on them.
  • Keep a written authorization and scope for every test.

What people use it for

  • Red teams documenting an authorized Pass-the-Ticket exercise in a lab using the report template.
  • Blue teams checking whether Kerberos ticket theft and reuse appear in their Event ID 4768 and 4769 logs.
  • Security engineers drafting detection logic for ticket use from unexpected IPs or hosts.
  • Analysts reviewing an exported Windows Security JSON log for signs of ticket abuse.

Frequently asked questions

Is the Pass-the-Ticket Attack Playbook skill free?

The source lists the skill under the Apache-2.0 licence, which governs how you may use and share the code. It does not list any price, so check the licence text for terms.

What do I need to run this skill?

You need Python 3.8 or newer, the pip packages rich and impacket, and Mimikatz or Rubeus for ticket extraction, which the skill references but does not include. The attack workflow also needs local admin on a test Windows host, and the log script needs a Windows Security event log exported as JSON.

Where do I install an agent skill?

Unzip the downloaded ZIP into ~/.claude/skills/ for a personal install or into a project's .claude/skills/ folder. In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.

Does this skill use the network?

According to the source, the skill does not use the network, but it does run scripts. Read the scripts before running them.

Can I use this skill against any Windows network?

No. The skill is for authorized security testing and detection validation. Using it against systems you do not own or lack written permission to test is illegal and harmful.

Is this a good way to learn Kerberos security from scratch?

Not really. The skill assumes a red-team background and offers little explanation of Kerberos, so learn the basics from other sources first.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits red teams running authorized Pass-the-Ticket exercises in a lab or contracted engagement, and blue teams or detection engineers validating Event ID 4768 and 4769 coverage. Beginners wanting to learn Kerberos from scratch, and anyone needing a fully verified attack tool, should pick something else, since the source says its script generates commands and text rather than automating the attack and was only partly reviewed.

Download the skill