Live Active security incident? Get immediate response
MITRE ATT&CK® Analytic

AN0954: Analytic 0954

Use of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events.

EnterpriseAN0954AnalyticObject v1.0 Modified
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Analytic 0954 matters because it focuses on a high-value identity signal: Windows logon sessions where an account appears to be in use without the expected interactive logon evidence. In business terms, this can indicate that identity controls are being bypassed through stolen Kerberos tickets or token impersonation rather than normal credential use. That makes it relevant to executive questions about privileged access assurance, incident triage speed, and whether SOC telemetry can distinguish legitimate user activity from impersonated sessions.

Executive priority

Prioritize this as an identity and Windows monitoring validation item, especially for environments where Kerberos-based authentication and privileged Windows access are important to operations. Leaders should ask whether the organization can prove how high-risk accounts logged on, whether expected interactive logon context is retained, and whether incident responders can quickly investigate suspicious account sessions. The value is less about this single analytic alone and more about whether identity evidence is complete enough to support containment, audit, and recovery decisions.

Technical view

The supplied ATT&CK object defines a Windows detection analytic for use of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events. Because no official detection logic, tactics, or relationships are supplied, SOC teams should treat this as a validation prompt: correlate Windows logon session creation with expected preceding or associated interactive logon evidence for the same account and host context. Gaps to test include incomplete Windows security event collection, inconsistent host coverage, missing authentication context, and service or administrative workflows that legitimately create sessions without standard interactive patterns.

Likely telemetry

  • Windows security authentication and logon events
  • Windows logon session metadata
  • Kerberos authentication-related evidence
  • Account, host, and session correlation data
  • Privileged account activity records

Detection direction

  • Validate that Windows logon session events are collected consistently from relevant systems before relying on this analytic.
  • Correlate account sessions against expected interactive logon evidence rather than alerting on isolated events without context.
  • Tune for legitimate administrative, service, scheduled task, or remote management patterns that may not resemble ordinary interactive logons.
  • Prioritize review for privileged or sensitive accounts, while avoiding unsupported assumptions about exploitation from the analytic alone.
  • Document telemetry gaps where Kerberos, account, host, or session context is unavailable, because those gaps directly limit analytic confidence.

Mitigation priorities

  • Strengthen identity governance for privileged and high-risk Windows accounts, including review of where interactive logon should be allowed.
  • Ensure incident response playbooks include investigation of suspicious logon sessions lacking expected interactive context.
  • Improve Windows authentication and session logging coverage before expanding alerting severity.
  • Use least-privilege and administrative access controls to reduce the business impact of account impersonation scenarios.
  • Maintain compliance-ready evidence showing how account logons, privileged sessions, and authentication anomalies are monitored.
Analyst notes and limits

This take is based only on the supplied ATT&CK analytic fields. The object is a detection analytic for Windows and describes suspicious logon sessions associated with stolen Kerberos tickets or token impersonation. No official detection query, tactic mapping, related techniques, or relationship context was supplied, so implementation should be driven by local Windows logging, identity architecture, and known administrative workflows.

The ATT&CK object does not provide detection logic, tactic classification, relationships, or validated data source details. This summary should not be read as evidence of active exploitation, attribution, customer exposure, or guaranteed detection coverage. Local baselining is required to separate suspicious impersonation patterns from legitimate non-interactive Windows activity.

Official MITRE ATT&CK definition

Analytic 0954

Use of stolen Kerberos tickets or token impersonation resulting in logon sessions from accounts without expected interactive logon events.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Relationship explorer

All related ATT&CK context

No relationships are available in the current normalized data for this object.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
d0f719657c4b1b01...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.0 Current bundle d0f719657c4b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    mitre-attack AN0954
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.