Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock

SigmaHQ Detections@sigmaHQ

•updated 25 days ago•0•0•0

Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is typically seen during a Kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question.