Best Detection of 2026 Series: Kerberoasting RC4 Service Ticket Requests with Abnormal SPN Fan-out
Detects anomalous Kerberos TGS ticket requests (Event ID 4769) using weak encryption (RC4/0x17) directed at multiple unique Service Principal Names (SPNs) from a single host or user within a short timeframe. This behavior is indicative of Kerberoasting, a technique used by attackers to harvest service account credentials for offline brute-force cracking.
Cortex XDR
