Skip to content
Threat Feed

Tag

Kerberoasting

3 briefs RSS
high advisory

PowerShell Kerberos Ticket Request via KerberosRequestorSecurityToken

This rule detects PowerShell scripts that request Kerberos service tickets using KerberosRequestorSecurityToken, potentially indicating Kerberoasting attacks for offline password cracking of service accounts.

Elastic Security kerberoasting credential_access windows
2r 1t
medium threat

Kerberos Traffic from Unusual Process

Detects network connections to the standard Kerberos port from an unusual process other than lsass.exe, potentially indicating Kerberoasting or Pass-the-Ticket activity on Windows systems.

Elastic Defend +22 kerberoasting credential-access lateral-movement windows
2r 2t
medium advisory

User Account ServicePrincipalName Attribute Modified

Detection of modifications to the servicePrincipalName attribute on user accounts, potentially exposing them to Kerberoasting attacks by allowing attackers to request Kerberos tickets for the account.

Active Directory kerberoasting credential-access windows spn
2r 2t