Kerberoasting TGS requests from host with recent remote-access tool session

ills3c Intel&Coffee@Ills3C

•updated today•0•0•1

Detects Kerberos service ticket principal name (SPN) enumeration or exposure events occurring shortly after the execution of common remote access tools (such as Quick Assist, AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, or LogMeIn) on the same device.