New episode of The Weekly Purple Team covering Pass-the-Ticket, and I wanted to share it here since it might be useful for people working on detection coverage for T1550.003. In this episode, we are Stealing Kerberos Tickets Past Defender and Credential Guard using AutoPtT

Video: [https://youtu.be/s5nd8u4EKFI\](https://youtu.be/s5nd8u4EKFI)

**What's covered:**

* Enumerating logon sessions and cached Kerberos tickets on Windows 11
* Using [AutoPtT](https://github.com/ricardojoserf/AutoPtT) to export a TGT by LogonId — it's a standalone PtT tool (C#/C++/Crystal/Python/Rust) built as an alternative to Rubeus/Mimikatz for this specific attack
* Taking that exported ticket and reusing it for authentication from a Linux box, not just staying inside the Windows ecosystem
* Detection side: what telemetry actually surfaces this LSASS access patterns, abnormal logon session behavior

Reference:
[https://github.com/ricardojoserf/AutoPtT\](https://github.com/ricardojoserf/AutoPtT)

Also touched on Credential Guard and Defender as mitigations — Credential Guard blocks the classic LSASS-memory extraction path, but it's not comprehensive coverage for PtT broadly, and rollout consistency across a fleet is worth double-checking rather than assuming.

Curious if others here are seeing PtT attempts that specifically try to pivot off-host post-export, or if most of what you're catching is still contained to the Windows side.

Hey,

a personal offline RAG system for offensive security knowledge. The idea is simple: instead of grepping through markdown files or trying to remember which writeup had that exact certipy command, you just ask naturally.

how do I escalate with SeImpersonatePrivilege
what did I do after getting ADFS access
sliver socks5 pivot setup
explain ESC8 vs ESC4

It retrieves from your actual notes first, then generates an answer grounded in what you've documented, not generic internet knowledge.

The use case I specifically built it for:

Two things kept coming up during engagements, I needed exact tool syntax I hadn't used in a while (Sliver commands especially, the docs are sparse), and I needed to quickly recall techniques from past machines without digging through notes. ZETSU solves both.

Two modes:

Operator: leads with the exact command, explanation after. For when you know what you need and just want the syntax.

Concept: leads with the reasoning, uses commands as illustrations. For when you need to understand a technique before using it.

Same retrieval either way, just different presentation.

How it works:

• At ingest time, an LLM reads each section of your writeups and extracts structured attack steps (Finding, Action, Reasoning, Result), so what you retrieve is a semantic unit, not a random 800-token window
• Hybrid BM25 + vector retrieval with RRF fusion, BM25 handles exact tool names and CVE numbers that embeddings smear, vector handles semantic similarity
• Cross-encoder reranker on top
• Supports local markdown files, URLs, GitHub wikis, and Atom/RSS feeds (0xdf, dirkjanm, harmj0y all ingestible directly)
• Backends: Anthropic, OpenAI-compatible (DeepSeek), or local Ollama

Benchmark:

Ran 910 questions across 12 offensive security categories. 93% of answers included correct commands, 68ms average retrieval, 7.3% context gaps where it correctly admitted missing information rather than hallucinating.

id love to hear you guys's feedback, i built this thing because i genuinely needed it, and going through my notes & endless cheatsheets was too much work when you're going through an engagement.

you can find it here: https://github.com/Chaelsoo/Zetsu