rubeus_monitor
Watch for new Kerberos TGT events and display them as they occur, without harvesting or renewing tickets.
Instructions
Monitor for new TGTs without harvesting/renewal.
Watches for new TGT events and displays them as they occur. Lighter weight than harvest - just observation.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| interval | No | Check interval (seconds, default 60) | |
| targetuser | No | Only monitor specific user | |
| nowrap | No | Don't wrap base64 output | |
| registry | No | Store tickets in registry | |
| runfor | No | Run for specified duration (seconds) |