Golden ticket
A forged Kerberos TGT signed with the domain's krbtgt key, letting an attacker impersonate any user with any group membership.
Domain controllers sign every Ticket Granting Ticket with the krbtgt account's key. An attacker who obtains that key (typically via DCSync or by stealing NTDS.dit after reaching domain admin) can mint TGTs offline for any user, with any groups and long lifetimes. ATT&CK tracks it as T1558.001. A silver ticket is the narrower version, forging service tickets with a service account's key.
Golden tickets mean full, persistent domain compromise: password resets for users do not help. Recovery requires resetting the krbtgt password twice, with the second reset after replication and the maximum ticket lifetime have passed, because the account keeps its previous key as valid.
Detection is hard; clues include TGS requests (4769) with no matching TGT issuance (4768), tickets with unusual lifetimes or encryption types, and accounts or groups that do not exist. Better to detect the precursors: DCSync replication requests from non-DC hosts.