PowerShell ScriptBlock Requests Kerberos Tickets via IdentityModel Token Assembly
Alerts on PowerShell ScriptBlock text that builds Kerberos ticket requests using KerberosRequestorSecurityToken and .GetRequest().
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-28
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell ScriptBlock activity that references System.IdentityModel.Tokens.KerberosRequestorSecurityToken and calls GetRequest(), indicating an attempt to construct or request Kerberos tickets. Such scripting can be used to obtain service tickets for specific SPNs, which is significant for credential access and Kerberos-focused abuse. It relies on PowerShell Script Block logging telemetry that captures the script text executed in-process.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_request_kerberos_ticket.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell ScriptBlock Requests Kerberos Tickets via IdentityModel Token Assembly
id: e5019227-acf0-4772-b82b-d8e8689a1cbe
related:
- id: caa9a802-8bd8-4b9e-a5cd-4d6221670219
type: similar
- id: a861d835-af37-4930-bcd6-5b178bfb54df
type: derived
status: test
description: This rule flags PowerShell ScriptBlock activity that references System.IdentityModel.Tokens.KerberosRequestorSecurityToken and calls GetRequest(), indicating an attempt to construct or request Kerberos tickets. Such scripting can be used to obtain service tickets for specific SPNs, which is significant for credential access and Kerberos-focused abuse. It relies on PowerShell Script Block logging telemetry that captures the script text executed in-process.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell
- https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_request_kerberos_ticket.yml
author: frack113, Huntrule Team
date: 2021-12-28
modified: 2025-11-18
tags:
- attack.credential-access
- attack.t1558.003
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- System.IdentityModel.Tokens.KerberosRequestorSecurityToken
- .GetRequest()
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1