warnKerberoasting — abnormal TGS requests

Encoded PowerShell execution on FIN-WKS-04

EDR flagged a PowerShell process launched with an encoded command, spawned by Microsoft Word, then opening an outbound TLS session to a Tor exit node. Classic phishing-to-C2 chain. Read the evidence, extract the IOCs, and map the behavior before you decide on containment.

severity CRITICAL
host     FIN-WKS-04  (Finance VLAN)
user     m.ortega  (standard privileges)
process  WINWORD.EXE → powershell.exe -nop -w hidden -enc SQBFAFgA...
network  outbound TLS → 185.220.101.4:443
detect   office_spawns_encoded_shell

Click any highlighted value to extract it as an IOC.