diamond

Overview

Create diamond tickets, a sophisticated ticket forgery technique that combines legitimate TGT components with forged elements. This approach leverages legitimate authentication while modifying specific ticket attributes, making detection significantly more challenging than traditional golden tickets.

Syntax

Rubeus.exe diamond /user:USER /password:PASSWORD [krbkey] [options]

Authentication Parameters

user

string

required

Username for authentication

password

string

Password for authentication

rc4

string

RC4/NTLM hash for authentication

aes128

string

AES128 key for authentication

aes256

string

AES256 key for authentication

Kerberos Key Parameters

krbkey

string

Kerberos key for ticket decryption/modification (AES256 preferred)

krbenctype

string

Encryption type for Kerberos key (default: aes256)

Modification Options

groups

string

Comma-separated list of group RIDs to inject

sids

string

Additional SIDs to include in ticket

endtime

string

Custom ticket end time

renew

string

Custom ticket renew time

Output Options

outfile

string

Save forged ticket to file

ptt

boolean

Pass-the-ticket (inject immediately)

Examples

# Create diamond ticket with password
Rubeus.exe diamond /user:testuser /password:password123 /krbkey:aes256_key /groups:512

# Create with hash authentication
Rubeus.exe diamond /user:serviceaccount /rc4:ntlm_hash /krbkey:aes256_key /groups:512,519

# Create and inject immediately
Rubeus.exe diamond /user:normaluser /password:pass /krbkey:key /groups:512 /ptt

# Custom groups and SIDs
Rubeus.exe diamond /user:user /password:pass /krbkey:key /groups:512,513 /sids:S-1-5-21-...-1001

# Custom timing
Rubeus.exe diamond /user:user /rc4:hash /krbkey:key /endtime:"12/31/2025 23:59:59" /groups:512

# Save to file for analysis
Rubeus.exe diamond /user:user /password:pass /krbkey:key /groups:512 /outfile:diamond.kirbi

Technical Overview

Diamond Ticket Concept

Hybrid Approach:

Starts with legitimate TGT from real authentication
Decrypts legitimate ticket components
Modifies specific attributes (groups, privileges)
Re-encrypts with legitimate structure

Advantages over Golden Tickets:

Uses legitimate authentication patterns
Maintains realistic ticket characteristics
Harder to detect than purely forged tickets
Leverages actual user credentials

Attack Flow

Process Steps:

Legitimate Authentication: Request TGT with valid credentials
Ticket Decryption: Decrypt TGT using KDC key material
Attribute Modification: Add privileged groups or SIDs
Re-encryption: Encrypt modified ticket with KDC key
Ticket Injection: Use modified ticket for authentication

Key Requirements:

Valid user credentials (password or hash)
KDC key material (KRBTGT key)
Understanding of ticket structure
Proper encryption handling

Credential Requirements

User Authentication

Legitimate Credentials:

Valid domain user password
User NTLM hash from previous compromise
User AES keys from Kerberos operations
Any authentication method accepted by KDC

Account Targeting:

Low-privilege user accounts (less suspicious)
Service accounts with legitimate access
Test accounts with known credentials
Accounts with minimal monitoring

KDC Key Material

KRBTGT Key Sources:

DCSync attacks against domain controllers
Memory dumps from compromised DCs
Cached KRBTGT keys from previous operations
Golden ticket creation prerequisites

Key Types:

# AES256 preferred for stronger encryption
Rubeus.exe diamond /user:user /password:pass /krbkey:aes256_krbtgt_key

# AES128 alternative
Rubeus.exe diamond /user:user /rc4:hash /krbkey:aes128_krbtgt_key /krbenctype:aes128

# RC4 for legacy compatibility
Rubeus.exe diamond /user:user /password:pass /krbkey:rc4_krbtgt_key /krbenctype:rc4

Privilege Escalation

Group Injection

Administrative Groups:

# Domain Admins
Rubeus.exe diamond /user:lowpriv /password:pass /krbkey:key /groups:512

# Enterprise Admins
Rubeus.exe diamond /user:user /rc4:hash /krbkey:key /groups:519

# Multiple administrative groups
Rubeus.exe diamond /user:user /password:pass /krbkey:key /groups:512,519,520

Group RID Reference:

512: Domain Admins
519: Enterprise Admins
520: Group Policy Creator Owners
518: Schema Admins
Custom organizational groups

SID Injection

Additional Privileges:

# Inject custom SIDs
Rubeus.exe diamond /user:user /password:pass /krbkey:key /sids:S-1-5-21-domain-1001,S-1-5-21-domain-1002

# Combine groups and SIDs
Rubeus.exe diamond /user:user /rc4:hash /krbkey:key /groups:512 /sids:S-1-5-21-domain-custom

SID Sources:

High-privilege custom groups
Service-specific permissions
Cross-domain trust relationships
Application-specific roles

Operational Advantages

Detection Evasion

Legitimate Characteristics:

Real authentication event logs
Valid ticket structure and timing
Proper encryption and signatures
Normal user authentication patterns

Reduced Indicators:

No purely forged ticket artifacts
Matches expected user behavior
Uses legitimate authentication flows
Maintains realistic ticket attributes

Persistence Benefits

Long-term Access:

Survives normal password changes (until KRBTGT rotation)
Maintains elevated privileges
Provides stealth administrative access
Supports long-term operations

Flexibility:

Use any legitimate user account
Modify privilege levels as needed
Create multiple variants for different purposes
Adapt to changing operational requirements

Integration Workflows

Post-Compromise Escalation

Complete Attack Chain:

# 1. Obtain legitimate user credentials
# Through various attack vectors (phishing, hash dumping, etc.)

# 2. Obtain KRBTGT key material
# Through DCSync or other domain controller compromise

# 3. Create diamond ticket
Rubeus.exe diamond /user:compromised_user /password:known_pass /krbkey:krbtgt_aes256 /groups:512 /ptt

# 4. Use elevated privileges
# Access domain controllers, perform administrative tasks

Stealth Administrative Access

Low-Profile Operations:

# 1. Use low-privilege account with known credentials
Rubeus.exe diamond /user:testuser /password:simple_pass /krbkey:krbtgt_key /groups:512

# 2. Perform administrative tasks
# Access restricted resources, modify domain objects

# 3. Clean up and return to normal operations
# Remove elevated access, return to baseline

Defensive Considerations

Detection Challenges

Limited Indicators:

Legitimate authentication events
Valid ticket structure and encryption
Normal user behavior patterns
Difficult to distinguish from legitimate access

Detection Opportunities:

Unusual privilege escalation patterns
Administrative access from low-privilege accounts
Ticket analysis for modified attributes
Behavioral analysis of user activities

Mitigation Strategies

Technical Controls:

Regular KRBTGT key rotation
Enhanced authentication monitoring
Privileged access management (PAM)
Ticket inspection and validation

Operational Measures:

Regular credential rotation
Monitoring for unusual administrative access
User behavior analytics
Incident response procedures

Troubleshooting

Common Issues

Authentication Failures:

Invalid user credentials
Account lockout or disabled status
Network connectivity problems
Domain controller accessibility

Ticket Creation Errors:

Incorrect KRBTGT key material
Encryption type mismatches
Invalid group or SID specifications
Timing or format issues

Optimization

Performance Improvements:

Use AES256 encryption for better security
Optimize group selections for specific targets
Cache KRBTGT keys for repeated use
Streamline authentication processes

Success Rate Enhancement:

Verify user account status before operation
Test KRBTGT key validity
Use realistic timing and attribute values
Monitor for defensive responses

golden - Traditional golden ticket forgery
asktgt - Legitimate TGT requests
ptt - Inject diamond tickets
describe - Analyze ticket structure

Getting Started

Ticket Operations

Attack Techniques

Miscellaneous

Overview

Syntax

Authentication Parameters

Kerberos Key Parameters

Modification Options

Output Options

Examples

Technical Overview

Credential Requirements

Privilege Escalation

Operational Advantages

Integration Workflows

Defensive Considerations

Troubleshooting

​Overview

​Syntax

​Authentication Parameters

​Kerberos Key Parameters

​Modification Options

​Output Options

​Examples

​Technical Overview

​Credential Requirements

​Privilege Escalation

​Operational Advantages

​Integration Workflows

​Defensive Considerations

​Troubleshooting

​Related Commands

Overview

Syntax

Authentication Parameters

Kerberos Key Parameters

Modification Options

Output Options

Examples

Technical Overview

Credential Requirements

Privilege Escalation

Operational Advantages

Integration Workflows

Defensive Considerations

Troubleshooting

Related Commands