Kerberoasting: GetUserSPNs TGS request and offline hashcat cracking

ills3c Intel&Coffee@Ills3C

•updated yesterday•5•0•91

Detects Kerberoasting activity on endpoints via the execution of Impacket's GetUserSPNs with request flags or hashcat executing Kerberos TGS cracking modes (13100/19700).