Mirrors/keyboardcrunch-sentinelone-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/sentinelone-queries synced 2026-06-11 02:11:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add detection for kerberoasting

Browse Source
This commit is contained in:
keyboardcrunch
2021-03-17 20:21:25 -05:00
parent 166e451cf6
commit 90651e37c2
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
queries/windows/kerberoasting.yml
+15
View File
@@ -0,0 +1,15 @@
title: Kerberoasting
description: Detects Kerberoasting through generic IndicatorName, excluding ManySPNRequests due to high FP.
author: keyboardcrunch
date: 17/03/2021
modified: null
mitre:
tactic: Credential Access
technique: T1558
subtechnique: 003
operating_system: linux
query: IndicatorName StartsWith "Kerberoasting"
false_positives: null
tags: null
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1558.003/T1558.003.md