{"id":"caa9a802-8bd8-4b9e-a5cd-4d6221670219","title":"Suspicious Kerberos Ticket Request via CLI","description":"Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class.\nThreat actors may use command line interfaces to request Kerberos tickets for service accounts in order to\nperform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse\ntechniques like silver ticket attacks.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-18","modified":"","tags":["attack.credential-access","attack.t1558.003"],"technique_ids":["T1558.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate command line usage by administrators or security tools."],"references":["https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell","https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_kerberos_kerberos_ticket_request_via_cli.yml","source_sha256":"d459efed1992d88a871f51b94acbb15bf6eeca8b4f59c97f097b504afc1778a4","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_kerberos_kerberos_ticket_request_via_cli.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Kerberos Ticket Request via CLI\nid: caa9a802-8bd8-4b9e-a5cd-4d6221670219\nrelated:\n    - id: a861d835-af37-4930-bcd6-5b178bfb54df\n      type: similar\nstatus: experimental\ndescription: |\n    Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class.\n    Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to\n    perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse\n    techniques like silver ticket attacks.\nreferences:\n    - https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell\n    - https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-11-18\ntags:\n    - attack.credential-access\n    - attack.t1558.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'powershell.exe'\n              - 'pwsh.dll'\n    selection_cli:\n        CommandLine|contains|all:\n            - 'System.IdentityModel.Tokens.KerberosRequestorSecurityToken'\n            - '.GetRequest()'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate command line usage by administrators or security tools.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1558.003","id":"T1558.003","name":"Kerberoasting","page":"techniques/enterprise/T1558.003/"}],"data_path":"data/detection-rules/caa9a802-8bd8-4b9e-a5cd-4d6221670219.json","kind":"sigma"}