Kerberoasting via Rubeus or Impacket Tool Execution

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects the execution of known Kerberoasting tools such as Rubeus and Impacket (GetST, GetTGT, asktgs) or command-line arguments indicative of Kerberoasting, specifically targeting RC4/ETYPE-23 ticket requests that are often used to crack service account passwords offline.