[Intro] (Vinyl crackle) Database seh mi deh inside. Domain controller seh... nobody came. (Silver ticket) [Verse 1] Analyst check di DCs fi di request Nothing inna di logs, but di database get guest Identity nobody expect a walk di floor Cah di ticket never pass through di front door T1558.002, MITRE write it down Service account hash — now dem print dem own crown Not di whole kingdom like di golden one, no Just one service, one host — but dat enough fi go [Pre-Chorus] Dem never ask di KDC Dem never queue, dem never ring Dem cook di ticket offline, bredda An' di service let dem in [Chorus] Silver ticket, nobody issue it Forged inna di dark, an' di service still use it Four-seven-six-nine never see it Missing log nuh mean it never happen — believe it Silver ticket (silver), check wha di door accept Not wha di desk give out — check di PAC, nuh forget [Verse 2] Where dem get di hash? Credential dump, Kerberoast Weak service accounts, a dem man love di most Event 4769 only log pon di DC It record di request, not every ticket yuh see Logon GUID can link it to a 4624 But sometimes it nuh capture — suh correlate more Tunable window, nuh label every gap But access wid no issuance? Dat deserve a map [Pre-Chorus] Dem never ask di KDC Dem never queue, dem never ring Dem cook di ticket offline, bredda An' di service let dem in [Chorus] Silver ticket, nobody issue it Forged inna di dark, an' di service still use it Four-seven-six-nine never see it Missing log nuh mean it never happen — believe it Silver ticket (silver), check wha di door accept Not wha di desk give out — check di PAC, nuh forget [Bridge] (Piano alone, spoken) Ask every service: who validate di PAC? Which signature? What happen when it fail? A control name inna spreadsheet a nuh proof. Test it. Cut di privilege. AES over RC4 where yuh can. [Verse 3] Mi nuh trust di desk, mi trust di bouncer pon di door Mi nuh trust di silence, mi trust what di logs dem store Keep di service secrets locked, rotate an' shrink Cah one leaked hash a more dan yuh think [Chorus] Silver ticket, nobody issue it Forged inna di dark, an' di service still use it Four-seven-six-nine never see it Missing log nuh mean it never happen — believe it Silver ticket (silver), check wha di door accept Not wha di desk give out — check di PAC, nuh forget [Outro] (Hummed hook) Nobody came... But somebody inside. (NDGM)
