CmdID / Techniques / T1558

T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force. MITRE ATT&CK

7 Sigma rules T1558.003 on attack.mitre.org

Part of

MITRE ATT&CK

T1558Steal or Forge Kerberos Tickets

Sigma rules tagged with it

process creation, the highest levels first

criticalHackTool - Rubeus ExecutionFlorian Roth (Nextron Systems) · Windows

highHackTool - GoldenDMSA ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

highHackTool - KrbRelay ExecutionFlorian Roth (Nextron Systems) · Windows

highHackTool - KrbRelayUp ExecutionFlorian Roth (Nextron Systems) · Windows

highHackTool - RemoteKrbRelay ExecutionNasreddine Bencherchali (Nextron Systems) · Windows

highSuspicious Kerberos Ticket Request via CLISwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumPotential SPN Enumeration Via Setspn.EXEMarkus Neis, keepwatch · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To find all the SPNs associated with _MyServer_ registered in the _contoso_ domain forest, type on the page for setspn

setspn -T contoso -F -Q */MyServerIdentify

An example is here when CmdID’s reading of it names T1558.003: a Sigma rule it trips is tagged with it, or its abuse is documented as it.