Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
174 detections
Filters
Last updated
All Time
Detection languages
82
28
22
18
8
Contributors
67
51
14
12
6
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
169
9
2
Products / Services
150
138
130
5
4
MITRE Techniques
100
91
40
29
22
CVEs
3
2
1
1
IDS Classtypes
3
1
1
IDS Protocols
3
2
Detects Kerberos service ticket requests (TGS-REQ) using RC4 encryption (etype 0x17) and specific ticket options (0x40810000), which are commonly associated with Kerberoasting attacks. This rule filters out service accounts (ending in $) to reduce noise, as these legitimate account types frequently request tickets.
Detects a single account requesting an abnormally large number of Kerberos service tickets (Event ID 4769) using weak RC4 encryption (0x17) within a short window. This pattern is characteristic of Kerberoasting attacks, where an adversary requests service tickets for offline password cracking.
Detects Kerberoasting activity by identifying a high volume of RC4-encrypted (0x17) Kerberos Service Ticket (TGS) requests from a single user account against multiple distinct service principal names (SPNs) within a short timeframe. This behavior is highly indicative of automated credential harvesting tools such as Rubeus or Impacket.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
This rule detects instances where a Kerberos Service Ticket (TGS, Event ID 4769) is requested without a corresponding TGT request (AS-REQ, Event ID 4768) from the same user and IP address within a 10-hour window. This behavior is indicative of potential Kerberoasting, where an attacker may have obtained TGS tickets using cached or manually constructed credentials rather than through the normal authentication flow.
This rule detects potential extraction or caching of Kerberos Ticket-Granting Tickets (TGT) by correlating Kerberos authentication events (4768/4769) with unauthorized access to the Local Security Authority Subsystem Service (lsass.exe). This pattern is often indicative of credential dumping tools like Mimikatz targeting Kerberos tickets on systems potentially used for delegation attacks.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos Ticket Granting Service (TGS) requests (Event ID 4769) that use RC4 encryption (0x17). In modern Active Directory environments, RC4 is considered weak and is often explicitly requested by attackers during Kerberoasting to facilitate offline brute-force cracking of service account passwords. The rule excludes common service accounts (e.g., krbtgt, machine accounts) to reduce noise.
Kerberos TGT Request Anomaly Detection
Cortex XDR
This rule detects potential indicators of forged Kerberos Ticket Granting Tickets (Golden Tickets). It monitors Kerberos authentication events (4768 and 4769) for specific anomalies, including ticket requests for non-existent accounts (Status 0x6), suspicious service requests (krbtgt with RC4 encryption), and abnormal ticket option usage, which are common artifacts of credential manipulation and forgery.
AS-REP Roasting Potential Enumeration
Cortex XDR
Detects Kerberos AS-REQ events (Event ID 4768) where accounts with Kerberos pre-authentication disabled successfully request an AS-REP ticket. Attackers exploit these accounts by requesting encrypted AS-REP blobs to perform offline password cracking. The rule flags potential enumeration when multiple unique accounts are targeted from the same source within a short timeframe.
Detects a potential Kerberoasting attempt by identifying a single user or IP requesting multiple RC4-encrypted Ticket Granting Service (TGS) tickets for distinct service accounts within a short timeframe. Kerberoasting involves requesting TGS tickets for service accounts, which are then used for offline brute-force cracking of the service account's password hash.
Detects successful Kerberos PKINIT authentication (Event 4768, PreAuthType 16) issued by on-premises certificate authorities. This activity is a potential indicator of Shadow Credentials or Active Directory Certificate Services (AD CS) abuse where attackers use forged or stolen certificates to authenticate as domain users or machines.
Detects Kerberos TGT requests (Event ID 4768) that utilize RC4 (PreAuthType 23) for pre-authentication. This is a common indicator of an Overpass-the-Hash attack, where an adversary uses a stolen NTLM hash to authenticate as a user and request a Kerberos ticket in environments that are typically configured for AES encryption.
Shows all Kerberos authentication activity on domain controllers - TGT requests, TGS requests, and pre-auth failures (4768/4769/4771). Good for hunting credential attacks, AS-REP roasting, weak encryption usage, and account lockout troubleshooting.
This rule detects Kerberos Service Ticket (TGS) requests made for the 'AZUREADSSOACC$' computer account, which is typically used for Seamless Single Sign-On (SSO) in hybrid Azure AD environments. The rule explicitly excludes known Domain Controllers from triggering the alert to focus on potentially suspicious TGS requests originating from other systems.
This rule monitors Kerberos TGS (Ticket-Granting Service) requests for suspicious patterns indicative of Kerberoasting, specifically looking for the use of weak encryption algorithms (RC4 or DES) and high volumes of service ticket requests for unique Service Principal Names (SPNs). It groups activity by source host and time window, flagging activity that involves DES encryption or a significant number of unique SPN requests. Great for detecting kerberoasting activity from unmanaged or rogue devices
This rule detects Kerberos Service Ticket (TGS) requests made for the 'AZUREADSSOACC$' computer account, which is typically used for Seamless Single Sign-On (SSO) in hybrid Azure AD environments. The rule explicitly excludes known Domain Controllers from triggering the alert to focus on potentially suspicious TGS requests originating from other systems.
This rule monitors Kerberos TGS (Ticket-Granting Service) requests for suspicious patterns indicative of Kerberoasting, specifically looking for the use of weak encryption algorithms (RC4 or DES) and high volumes of service ticket requests for unique Service Principal Names (SPNs). It groups activity by source host and time window, flagging activity that involves DES encryption or a significant number of unique SPN requests. Great for detecting kerberoasting activity from unmanaged or rogue devices
Page 4 of 9