Important Detection 2026 – Kerberoasting: Abnormal TGS Requests (RC4/Multi-SPN)
Detects anomalous patterns of Kerberos Ticket Granting Service (TGS) requests using RC4 encryption (0x17), which is a common indicator of Kerberoasting attacks. The rule identifies accounts requesting a high volume of service tickets for distinct Service Principal Names (SPNs), excluding the krbtgt account.
Cortex XDR
