Pass the Ticket MITRE ATT&CK technique T1097 Tactic: Lateral Movement Platform: Windows Deception Techniques Fake Kerberos ticket Useful Resources Systems and methods for the detection of advanced attackers using client side honeytokens (Patent) Detecting Kerberoasting Activity Part 2 – Creating a Kerberoast Service Account Honeypot Busting the Honeypot – Is there really a way for attackers to detect deception