Skip to content
Threat Feed
Subscribe

Tag

Powerview

3 briefs RSS
medium advisory

Detection of PowerView Kerberoasting via Get-DomainSPNTicket

This brief documents the use of the PowerView PowerShell cmdlet Get-DomainSPNTicket to conduct Kerberoasting, a technique that extracts Kerberos service tickets for offline password cracking.

credential-access kerberoasting powerview active-directory powershell
1r 1t
medium advisory

Detection of PowerView Domain Group Enumeration via PowerShell

Adversaries leverage the PowerView cmdlet 'Get-DomainGroup' via PowerShell to perform Active Directory reconnaissance and identify group memberships for lateral movement.

active-directory discovery powerview reconnaissance
1r 1t
medium advisory

Detection of PowerView Get-DomainTrust Reconnaissance

Adversaries utilize the PowerView PowerShell module's Get-DomainTrust command to perform Active Directory reconnaissance, facilitating lateral movement planning by mapping domain trust relationships.

active-directory discovery powerview powershell reconnaissance
1r 1t