Tag
Detection of PowerView Kerberoasting via Get-DomainSPNTicket
1 rule 1 TTPThis brief documents the use of the PowerView PowerShell cmdlet Get-DomainSPNTicket to conduct Kerberoasting, a technique that extracts Kerberos service tickets for offline password cracking.
Suspicious Kerberos Ticket Request via PowerShell CLI
1 rule 1 TTPAdversaries utilize the System.IdentityModel.Tokens.KerberosRequestorSecurityToken class via PowerShell command lines to conduct Kerberoasting and ticket-based credential access attacks.
Windows AD ServicePrincipalName Added To Domain Account
2 rules 1 TTPThis Splunk analytic detects the addition of a Service Principal Name (SPN) to a domain account by monitoring Windows Event Code 5136 and changes to the servicePrincipalName attribute, potentially indicating Kerberoasting attempts leading to unauthorized access.
PowerShell Kerberos Ticket Request via KerberosRequestorSecurityToken
2 rules 1 TTPThis rule detects PowerShell scripts that request Kerberos service tickets using KerberosRequestorSecurityToken, potentially indicating Kerberoasting attacks for offline password cracking of service accounts.
Kerberos Traffic from Unusual Process
2 rules 2 TTPsDetects network connections to the standard Kerberos port from an unusual process other than lsass.exe, potentially indicating Kerberoasting or Pass-the-Ticket activity on Windows systems.
User Account ServicePrincipalName Attribute Modified
2 rules 2 TTPsDetection of modifications to the servicePrincipalName attribute on user accounts, potentially exposing them to Kerberoasting attacks by allowing attackers to request Kerberos tickets for the account.