Detectionhighexperimental

Suspicious Kerberos Ticket Request via CLI

Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class. Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse techniques like silver ticket attacks.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan Poudel (Nextron Systems)Created Tue Nov 18caa9a802-8bd8-4b9e-a5cd-4d6221670219windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'powershell.exe'
              - 'pwsh.dll'
    selection_cli:
        CommandLine|contains|all:
            - 'System.IdentityModel.Tokens.KerberosRequestorSecurityToken'
            - '.GetRequest()'
    condition: all of selection_*

False Positives

Legitimate command line usage by administrators or security tools.

References

MITRE ATT&CK

Tactics

TA0006 · Credential Access

Sub-techniques

T1558.003 · Kerberoasting

Related Rules

SimilarDetectionhigh

Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock

Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is typically seen during a Kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

caa9a802-8bd8-4b9e-a5cd-4d6221670219

Status

experimental

Level

high

Type

Detection

Created

Tue Nov 18

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_powershell_kerberos_kerberos_ticket_request_via_cli.yml

Raw Tags

attack.credential-accessattack.t1558.003

View on GitHub