Kerberoasting via Rubeus, Invoke-Kerberoast, or Impacket GetUserSPNs

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

Detects the execution of known Kerberoasting tools or commands that indicate an attempt to request Kerberos service tickets for offline cracking. This activity is a core component of the Kerberoasting attack technique.