kqlElastic-2.0from elastic/detection-rules

PowerShell Kerberos Ticket Request

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1003 T1558 T1558.003 T1059 T1059.001

Rule sourcerules/windows/credential_access_posh_request_ticket.toml

event.category:process and host.os.type:windows and
  powershell.file.script_block_text : (
    KerberosRequestorSecurityToken
  ) and not user.id : ("S-1-5-18" or "S-1-5-20") and
  not powershell.file.script_block_text : (
    ("sentinelbreakpoints" and ("Set-PSBreakpoint" or "Set-HookFunctionTabs")) or
    ("function global" and "\\windows\\sentinel\\4")
  )