T1558.003Credential Access
Kerberoasting
Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force. Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
21 Sigma rules tagged T1558.003KerberoastingT1558.00321 general rules
- HackTool - Rubeus Executioncriticalstable
- HackTool - KrbRelay Executionhightest
- HackTool - KrbRelayUp Executionhightest
- HackTool - RemoteKrbRelay Executionhightest
- HackTool - Rubeus Execution - ScriptBlockhightest
- Register new Logon Process by Rubeushightest
- Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlockhightest
- User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'hightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Kerberoasting
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.