Techniques
Sample rules
Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock
- source: sigma
- technicques:
- t1558
- t1558.003
Description
Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is typically seen during a Kerberoasting or silver ticket attack. A TGS request is issued by the KerberosRequestorSecurityToken constructor, resulting tickets are cached in LSA and become extractable by other tools later on.
Detection logic
condition: selection
selection:
ScriptBlockText|contains: System.IdentityModel.Tokens.KerberosRequestorSecurityToken