Golden Ticket: Anomalous Kerberos TGT Encryption/Lifetime
Detects Kerberos TGT and service ticket requests that utilize deprecated or weak encryption types (RC4/DES) often associated with Golden Ticket attacks, specifically in environments where AES is mandated. The rule groups these events by user, service, and IP address to identify potential anomalies indicative of credential forgery.
CQL
