Golden Ticket - Forged Kerberos KRBTGT Ticket Detected
Detects Kerberos service tickets for the 'krbtgt' account that utilize RC4 encryption (0x17) or possess a suspiciously long lifetime (exceeding 10 hours). These conditions are common indicators of Golden Ticket attacks or potential credential manipulation, as legitimate TGTs should not typically exhibit these properties.
Microsoft Sentinel (KQL)
