klist.exe Advanced Kerberos Subcommands – Recon via sessions, -li, get, purge

Renata Cardoso@rcardososec

•updated Jul 1, 2026•4•0•9

Detects the use of the klist.exe utility with suspicious subcommands ('sessions', '-li', 'get', 'purge') to inspect, retrieve, or clear cached Kerberos tickets, which is indicative of credential discovery or post-exploitation activity.