MITRE ATT&CK detection coverage

← Back to main site

Home/ MITRE Matrix/ Credential Access/ T1558.003

T1558.003Kerberoasting

T1558.003 — Kerberoasting is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 8 detection use cases covering it.

Credential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

8Use cases

0Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1558 · Steal or Forge Kerberos Tickets

Use cases covering this technique (8)

Kerberoasting spn request with RC4 encryption ESCU actions · alerting P Rubeus Command Line Parameters ESCU actions · alerting P ServicePrincipalNames Discovery with PowerShell ESCU actions · alerting P ServicePrincipalNames Discovery with SetSPN ESCU actions · alerting P Unusual Number of Kerberos Service Tickets Requested ESCU actions · hunting P Windows PowerView Kerberos Service Ticket Request ESCU actions · alerting P Windows PowerView SPN Discovery ESCU actions · alerting P Windows Process With NetExec Command Line Parameters ESCU actions · alerting P