Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
174 detections
Filters
Last updated
All Time
Detection languages
82
28
22
18
8
Contributors
67
51
14
12
6
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
169
9
2
Products / Services
150
138
130
5
4
MITRE Techniques
100
91
40
29
22
CVEs
3
2
1
1
IDS Classtypes
3
1
1
IDS Protocols
3
2
This rule detects the use of `System.IdentityModel.Tokens.KerberosRequestorSecurityToken` within PowerShell script blocks. This specific class is used to request Kerberos service tickets (TGS) for a given Service Principal Name (SPN). This behavior is commonly observed in Kerberoasting attacks (T1558.003) where an attacker requests service tickets to crack their hashes offline, or in some cases, during the initial stages of a silver ticket attack (T1558.002) to gather SPNs. A successful execution of such a script would typically output the SPNs for the targeted endpoint.
Detects service ticket requests using the weak RC4 encryption type (0x17) for Kerberos, which is often abused in Kerberoasting attacks. The rule specifically looks for Event ID 4769 (A Kerberos service ticket was granted) where the TicketOptions indicate a forwardable and renewable ticket, and the TicketEncryptionType is RC4. It attempts to reduce false positives by excluding service names ending with a dollar sign, which are typically machine accounts.
Detects failed Kerberos TGT issue operations. This can be a sign of manipulations of TGT messages by an attacker, potentially indicating attempts to exploit Kerberos for credential access or to bypass authentication mechanisms.
Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.
Detects service ticket requests using RC4 encryption type
Page 9 of 9