Detectionmediumtest

Potential SPN Enumeration Via Setspn.EXE

Detects service principal name (SPN) enumeration used for Kerberoasting

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Markus Neis, keepwatchCreated Wed Nov 14Updated Mon Oct 231eeed653-dbc8-4187-ad0c-eeebb20e6599windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_pe:
        - Image|endswith: '\setspn.exe'
        - OriginalFileName: 'setspn.exe'
        - Description|contains|all:
              - 'Query or reset the computer'
              - 'SPN attribute'
    selection_cli:
        CommandLine|contains:
            - ' -q '
            - ' /q '
    condition: all of selection_*