Sapphire tickets
Theory
Sapphire tickets are similar to Diamond tickets in the way the ticket is not forged, but instead based on a legitimate one obtained after a request. The difference lays in how the PAC is modified. The Diamond ticket approach modifies the legitimate PAC. In the Sapphire ticket approach, the PAC of another powerful user is obtained through an S4U2self+u2u trick. This PAC then replaces the one featured in the legitimate ticket. The resulting ticket is an assembly of legitimate elements, and follows a standard ticket request, which makes it then most difficult silver/golden ticket variant to detect.
Practice
Since Diamond tickets modify PACs on-the-fly to include arbitrary group IDs, chances are some detection software are (of will be) able to detect discrepancies between a PAC's values and actual AD relationships (e.g. a PAC indicates a user belongs to some groups when in fact it doesn't).
Sapphire tickets are an alternative to obtaining similar tickets in a stealthier way, by including a legitimate powerful user's PAC in the ticket. There will be no discrepancy anymore between what's in the PAC and what's in Active Directory.
The powerful user's PAC can be obtained through an S4U2self+u2u trick.
From UNIX-like systems, Impacket's ticketer (Python) script can be used for such purposes with the -impersonate argument.
The arguments used to customize the PAC from scratch are ignored (-groups, -extra-sid, -duration) since the PAC is taken from the ticket obtained beforehand; -user-id and the key material (-nthash/-aesKey) are honored, the required domain SID (-domain-sid) as well as the username supplied in the positional argument (baduser in this case). All these information will be kept as-is from the PAC obtained beforehand using the S4U2self+u2u trick.
ticketer.py -request -impersonate 'domainadmin' -domain 'DOMAIN.FQDN' -user 'domain_user' -password 'password' -aesKey 'krbtgt/service AES key' -domain-sid 'S-1-5-21-...' 'baduser'KDC_ERR_TGT_REVOKED on patched domains (KB5008380 / CVE-2021-42287)
Since the PAC_REQUESTOR enforcement phase (October 2022), TGTs must carry the new PAC_REQUESTOR and PAC_ATTRIBUTES_INFO structures or the KDC raises KDC_ERR_TGT_REVOKED. Because the Sapphire technique lifts a privileged PAC from an S4U2self + U2U service ticket (which never contains those structures), a forged TGT built from it lacks them and is rejected on essentially every patched (2022+) domain. Use tooling that re-adds them: Impacket (PR #1391, #1545) and Rubeus (PR #105).
Resources
Precious Gemstones: The New Generation of Kerberos Attacksunit42.paloaltonetworks.com