LoFP / legitimate command line usage by administrators or security tools

Techniques

• t1558
• t1558.003

Sample rules

Suspicious Kerberos Ticket Request via CLI

• source: sigma
• technicques:
  • t1558
  • t1558.003

Description

Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class. Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse techniques like silver ticket attacks. Encoded commands will not surface the class name, so the ps_script rule covers that instead.

Detection logic

condition: all of selection_*
selection_cli:
  CommandLine|contains: System.IdentityModel.Tokens.KerberosRequestorSecurityToken
selection_img:
- Image|endswith:
  - \powershell.exe
  - \pwsh.exe
- OriginalFileName:
  - powershell.exe
  - pwsh.dll