Correlated LDAP Recon and Kerberoasting
This rule detects a correlated attack chain involving LDAP Service Principal Name (SPN) enumeration followed by Kerberoasting activity. It identifies an actor performing LDAP queries for SPNs, then links that actor to subsequent Kerberos Ticket-Granting Service (TGS) requests for those service accounts within a defined time window. The rule specifically looks for a minimum number of unique service accounts targeted to trigger an alert, indicating a potential Kerberoasting attack.
Microsoft Sentinel (KQL)
