Active Directory Kerberos DLL Loaded Via Office Application

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•23

Detects when an Office application loads the 'kerberos.dll' library. This behavior is unusual for standard Office operations and could indicate an attempt to manipulate Kerberos authentication, potentially for credential access or privilege escalation.