Triage Tickets (Invoke-RubeusTriage)

Description

Displays a summary table of all Kerberos tickets across logon sessions.

Overview

Displays a concise summary table of all Kerberos tickets across logon sessions. Shows the LUID, client principal, server principal, encryption type, start time, end time, and renewal time for each cached ticket. Useful for quick reconnaissance of cached credentials.

Arguments

Parameter Type Description
Luid string The target logon session LUID.
User string Filter by client username.
Service string Filter by service name.

Additional Parameters

  • Server: Filter by server name.

Dependencies

  • AD

Operating Systems

  • Windows
Scroll to Top