Rule Info
Name
Klist Utility Execution
Author
MalGamy (Nextron Systems)
Description
Detects the execution of the klist utility, which can be used to enumerate Kerberos tickets and may indicate reconnaissance activity.
Date
2025-01-22 00:00:00
Modified
None
Id
893a0ef4-8867-4242-a8e1-708ee74f2f0b
Tags
attack.discovery attack.t1087 attack.t1482
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR