parse kerberos pcap csv or evtx 4768/4769 · flag as-rep roast · rc4 kerberoast bursts · runs locally
kerberos csv
drop pcap or evtx csv
or click
auto-detects evtx (eventid column) vs wireshark/tshark kerberos export
drop kerberos pcap csv or security evtx csv (4768/4769)