Skip to content
Threat Feed
Subscribe

Tag

Pass-the-Ticket

2 briefs RSS
high advisory

Kerberos Ticket Dump via Kirbi File Creation

The creation of .kirbi files on Windows systems indicates potential Kerberos ticket dumping using tools like Mimikatz, preceding Pass-The-Ticket attacks.

Windows +1 credential-access kerberos mimikatz pass-the-ticket
2r 2t
high advisory

Detects Kirbi File Creation

Detects the creation of .kirbi files, a suspicious Kerberos ticket artifact often produced by ticket export or dumping tools such as Rubeus or Mimikatz, indicating preparation for Kerberos ticket theft or Pass-The-Ticket (PTT) attacks.

Microsoft Defender XDR +2 credential-access kerberos pass-the-ticket mimikatz rubeus
2r 1t