Kerberoasting
Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to [Brute Force](https://attack.mitre.org/techniques/T1110).(Citation: Empire InvokeKerberoast Oct 2016)(Citation: AdSecurity Cracking Kerberos Dec 2015) Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least ...
BY SOURCE
PROCEDURES (26)
Auto-extracted: 2 detections for token
Auto-extracted: 2 detections for encrypt
Auto-extracted: 2 detections for spray
Auto-extracted: 2 detections for kerbero
Auto-extracted: 2 detections for script block
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for authentication monitoring
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for privilege