Silver Ticket
A forged Kerberos service ticket. Grants access to a single service on a single host — but never writes a line into the domain controller's logs.
The difference from a Golden Ticket lies in which key is used. The latter forges ticket-granting tickets with the krbtgt account's hash and therefore grants access to everything. A silver ticket is signed with the individual service account's own hash instead, which suffices because it is the service itself that validates the ticket using its own key. The domain controller is therefore never involved, and so there is no logon event to detect anywhere centrally. That makes the technique considerably quieter than its golden counterpart, at the cost of reach. All you need is the service account's hash — or a computer account's, if the target is file sharing. The defences are PAC validation and regular machine account password rotation.