AS-REP Roasting: GetNPUsers/hashcat tooling and Kerberos AS-REP requests

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•2

Detects potential AS-REP Roasting activity through two branches: endpoint tooling execution such as GetNPUsers or hashcat with AS-REP related flags, and domain controller Kerberos TGT requests (Event ID 4768) indicating pre-authentication disabled (PreAuthType 0) using RC4 encryption across multiple accounts from a single source IP.