Query: detection rule: Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurity
Matching passage: Sigma rule: Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurity. Logsource: windows / process_creation. Rule: title: Suspicious Kerberos Ticket Request via CLI id: caa9a802-8bd8-4b9e-a5cd-4d6221670219 related: - id: a861d835-af37-4930-bcd6-5b178bfb54df type: similar status: experimental description: 'Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class. Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse techniques like silver ticket attacks. ' references: - https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell - https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-18 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell.exe - pwsh.dll selection_cli: CommandLine|contains|all: - System.IdentityModel.Tokens.KerberosRequestorSecurityToken - .GetRequest() condition: all of selection_* falsepositives: - Legitimate command line usage by administrators or security tools. level: high
Near-miss passage: Sigma rule: Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use of the `personality`. Logsource: linux / auditd. Rule: title: ASLR Disabled Via Sysctl or Direct Syscall - Linux id: e497a24e-9345-4a62-9803-b06d7d7cb132 status: experimental description: "Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:\n - Use of the\ \ `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)\n - Modification of the /proc/sys/kernel/randomize_va_space\ \ file\n - Execution of the `sysctl` command to set `kernel.randomize_va_space=0`\nDisabling ASLR is often used by attackers\ \ during exploit development or to bypass memory protection mechanisms.\nA successful use of these methods can reduce the\ \ effectiveness of ASLR and make memory corruption attacks more reliable.\n" references: - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md - https://man7.org/linux/man-pages/man2/personality.2.html - https://manual.cs50.io/2/personality - https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/ author: Milad Cheraghi date: 2025-05-26 modified: 2025-12-05 tags: - attack.privilege-escalation - attack.stealth - attack.defense-impairment - attack.t1685 - attack.t1055.009 logsource: product: linux service: auditd detection: selection_syscall: type: SYSCALL SYSCALL: personality a0: 40000 selection_sysctl: type: EXECVE a0: sysctl a1: -w a2: kernel.randomize_va_space=0 condition: 1 of selection_* falsepositives: - Debugging or legitimate software testing level: high