Detect Concurrent Hello for Business PRT Tokens for One Device

Robbe Van den Daele@RobbeVdDaele

•updated Aug 19, 2025•3•0•59

This detection rule tries to find multiple PRT tokens being used simultaneously for one device. This might indicate that an attacker was able to request a new PRT on a second device using exxported Windows Hello for Business keys. More information about the attack scenario can be found in the references.