Detecting Pass The Ticket Attacks Claude Skill

Analyzes Kerberos authentication events for suspicious ticket-use patterns, translating observations into SIEM detections and investigation questions.

Published by mukul975mukul975/Anthropic-Cybersecurity-Skills/detecting-pass-the-ticket-attacks

Source repositorymukul975/Anthropic-Cybersecurity-Skills
Source licenseApache-2.0
Pinned54a7988
Source checked2026-10-18

Third-party community repo, not affiliated with Anthropic

Open source on GitHub

.install .install-tabs{display:none}.install .install-panel[hidden]{display:block}@media (max-width:767px){.install .install-panel[hidden]{display:flex}}.install .install-panel+.install-panel{border-top:1px solid var(--line)}.install .install-panel-label{display:block}.install .install-all{display:none}

Install

Pick your client, then copy the command.

Claude Code

Personal skills in ~/.claude/skills (use .claude/skills for one project)

git clone 'https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git'
cd Anthropic-Cybersecurity-Skills && git checkout 54a798831d2266a3ca61ce68a7acb80b81160d57
mkdir -p ~/.claude/skills && cp -R skills/detecting-pass-the-ticket-attacks ~/.claude/skills/detecting-pass-the-ticket-attacks

Codex

No Codex snippet verified for this entry yet

Compatibility is not confirmed, so there is no copy-ready command. Start from the pinned checkout and follow the source docs for where the folder goes.

Pinned checkout (same for every client)

git clone 'https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git'
cd Anthropic-Cybersecurity-Skills && git checkout 54a798831d2266a3ca61ce68a7acb80b81160d57

Read pinned setup documentation Codex skills documentation

Cursor

No Cursor snippet verified for this entry yet

Compatibility is not confirmed, so there is no copy-ready command. Start from the pinned checkout and follow the source docs for where the folder goes.

Pinned checkout (same for every client)

git clone 'https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git'
cd Anthropic-Cybersecurity-Skills && git checkout 54a798831d2266a3ca61ce68a7acb80b81160d57

Read pinned setup documentation

Git

Check out the pinned revision

git clone 'https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git'
cd Anthropic-Cybersecurity-Skills && git checkout 54a798831d2266a3ca61ce68a7acb80b81160d57

Any agent

Paste into your agent chat

Read the source at https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/54a798831d2266a3ca61ce68a7acb80b81160d57/skills/detecting-pass-the-ticket-attacks/SKILL.md (pinned revision 54a798831d22). Explain what it does and which tools, credentials and network access it needs. Do not install or run anything until I confirm.

How to install Claude Code skills: compare folder, plugin and CLI methods

All client instructions (works without JavaScript)

Claude Code

Personal skills in ~/.claude/skills (use .claude/skills for one project)

git clone 'https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git'
cd Anthropic-Cybersecurity-Skills && git checkout 54a798831d2266a3ca61ce68a7acb80b81160d57
mkdir -p ~/.claude/skills && cp -R skills/detecting-pass-the-ticket-attacks ~/.claude/skills/detecting-pass-the-ticket-attacks

Codex

No dedicated setup snippet verified for this client. Review the shared setup and pinned source below; compatibility is not confirmed.

Read pinned source

Cursor

No dedicated setup snippet verified for this client. Review the shared setup and pinned source below; compatibility is not confirmed.

Read pinned source

Git

Check out the pinned revision

git clone 'https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git'
cd Anthropic-Cybersecurity-Skills && git checkout 54a798831d2266a3ca61ce68a7acb80b81160d57

Any agent

Paste into your agent chat

Read the source at https://github.com/mukul975/Anthropic-Cybersecurity-Skills/blob/54a798831d2266a3ca61ce68a7acb80b81160d57/skills/detecting-pass-the-ticket-attacks/SKILL.md (pinned revision 54a798831d22). Explain what it does and which tools, credentials and network access it needs. Do not install or run anything until I confirm.

Listed ≠ audited. Snippets follow the pinned source docs; review the source and any scripts before running them. Nothing is installed from this page.

Source record

Repository: mukul975/Anthropic-Cybersecurity-Skills
Source file: skills/detecting-pass-the-ticket-attacks/SKILL.md
Pinned revision: 54a7988
Upstream commit: 31 Aug 2026
Last checked: 18 Oct 2026
License: Apache-2.0

No review scores. No automatic installs. Not affiliated with the publisher.

Source assessment

34,631 GitHub stars · Repository push 2026-08-31

Static risk · Medium Quality 85/100

Signals describe text in the listed files, not proven runtime behavior. “Not observed” does not mean absent. This is not a security certification.

Shell commands: Not observed
Network references: Observed
File reading: Observed
File writing: Not observed
Credential references: Observed

Scanned files: 2 · Unscanned companion scripts: 0

Inspect scan evidence

skills/detecting-pass-the-ticket-attacks/SKILL.md · skills/detecting-pass-the-ticket-attacks/scripts/agent.py

How the score is calculated

Documentation 30/40 + Maintenance 20/25 + Stars 20/20 + License 15/15 = 85/100.

Read the complete formula, filters and limitations

License scope: skill frontmatter. README

Snapshot: 2026-10-18T08:26:08 UTC · asd-static-v1

What you are opening

A public SKILL.md with instructions for an agent. Open the pinned source to inspect its complete scope, dependencies and permissions.

How to set it up

Open the pinned SKILL.md and read its instructions and any bundled scripts.
Copy the skill folder into your client’s skills directory with the snippet in the install card.
Start a new session and ask for the task the skill describes.

Before you add it

Read the instructions and review any scripts before running them.
Check tool access, required credentials and third-party network requests.
The source license and any resource-specific terms take precedence.

Source assessment

How the score is calculated

What you are opening

How to set it up

Before you add it

More from mukul975/Anthropic-Cybersecurity-Skills

Other Claude skills