Skip to content
Threat Feed

Tag

Pass-the-Ticket

1 brief RSS
high advisory

Detects Kirbi File Creation

Detects the creation of .kirbi files, a suspicious Kerberos ticket artifact often produced by ticket export or dumping tools such as Rubeus or Mimikatz, indicating preparation for Kerberos ticket theft or Pass-The-Ticket (PTT) attacks.

Microsoft Defender XDR +2 credential-access kerberos pass-the-ticket mimikatz rubeus
2r 1t