Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock

Title: Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock
Status: test
Description:Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets. This behavior is typically seen during a Kerberoasting or silver ticket attack. A TGS request is issued by the KerberosRequestorSecurityToken constructor, resulting tickets are cached in LSA and become extractable by other tools later on.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell
  -https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1
Author: frack113
Date: 2021-12-28
modified:2026-09-14
Tags:

• -'attack.credential-access'
• -'attack.t1558.003'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains: 'System.IdentityModel.Tokens.KerberosRequestorSecurityToken'
  condition:selection
Falsepositives:
  -Legitimate Kerberos authentication development and troubleshooting scripts
Level: high