CISSP GLOSSARY · IDENTITY & ACCESS MANAGEMENT
Silver ticket attack
Forging a Kerberos service ticket with a stolen service account password hash. Scope is limited to that one service, but the attack never touches the KDC, so it leaves almost no logs.
A silver ticket attack forges a Kerberos service ticket using the stolen password hash of a service account. Where the golden ticket attack forges the TGT and unlocks the whole domain, a silver ticket unlocks exactly one service: the one whose Service Principal Name the compromised account owns.
The trade-off is stealth. A forged service ticket is presented directly to the target service, so the attacker never contacts the KDC and the domain controllers log nothing. The service account hash that enables the attack is often obtained through Kerberoasting, which makes these two attacks natural neighbours in a scenario. The full walkthrough is in the silver ticket guide.
Exam relevance: the exam contrasts silver against golden on three axes. Scope: one service versus the entire domain. Key material: a service account hash versus the KRBTGT hash. Detectability: no KDC contact versus forged TGTs that at least transit the KDC. A scenario about quiet, targeted access to a single SQL Server or file share is describing a silver ticket.