Kerberos Exploit for Credential Theft Delivery

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•9

This rule detects HTTP traffic containing the string "KerberosRequestorSecurityToken" in the file data, indicating a potential Kerberos exploit for credential theft delivery. The detection is focused on traffic flowing from the server to the client.