Kerberoasting via Rubeus or PowerView SPN Queries (T1558.003)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•2•0•7

Detects the execution of known Kerberoasting tools or commands, specifically identifying the use of Rubeus, GetUserSPNs, or processes containing strings related to Kerberoasting, which indicates attempts to extract Kerberos service tickets for offline brute-force attacks.