Elastic high stable kql

PowerShell Kerberos Ticket Request

Detects PowerShell script content that references KerberosRequestorSecurityToken, which can request Kerberos service tickets. Attackers request service tickets to perform Kerberoasting for offline password cracking of service accounts.

View Source

Detection Logic

event.category:process and host.os.type:windows and
  powershell.file.script_block_text : "KerberosRequestorSecurityToken" and
  not powershell.file.script_block_text : (
    ("sentinelbreakpoints" and ("Set-PSBreakpoint" or "Set-HookFunctionTabs")) or
    ("function global" and "\\windows\\sentinel\\4")
  )

Field Validations

Loading…

Comments (0)

Loading comments...