==================================================

CREATED: ANY-POWERSHELL-IDENTITY-MODEL (#1964)

Description

This detector identifies the use of PowerShell to request the service ticket for a given Service Principal Name (SPN). This will put the ticket in memory to allow it to be exported from user memory space using a tool like Mimikatz.

ATT&CK Technique T1097

Did this answer your question?