Golden Ticket
A Golden Ticket is a forged Kerberos ticket granting ticket, created offline using the key of the domain’s krbtgt account. Because every ticket in the domain is validated against that key, an attacker holding it can mint credentials for any user, including ones that do not exist, with any group membership they choose.
It is not a route in; it is what an attacker does once they are already domain administrator, because obtaining the krbtgt key requires that level of access. What it buys is persistence that survives the usual response. Resetting every user password, rebuilding the compromised hosts and revoking sessions does not help, because the forged ticket does not correspond to any account whose password was changed. It is signed with a key the domain still trusts.
The consequence a CISO needs to hear is the recovery cost. Removing it means rotating the krbtgt account password twice, because the directory keeps the current and previous key, and a single rotation leaves the old one valid. The two rotations have to be separated enough for replication to complete across every domain controller, and doing them too quickly breaks authentication estate wide.
In a report this is written as an impact statement rather than as a finding of its own: the finding is whatever allowed domain administrator to be reached, and this is what that access means. On an engagement we demonstrate the capability and record it, rather than leaving forged material in place, and the report states plainly that recovery of a domain compromised at this level is a rebuild question, not a clean up question. This falls under the internal testing where domain persistence is demonstrated and then handed back.