Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
229 detections
Filters
Last updated
All Time
Detection languages
92
56
25
20
16
Contributors
63
54
46
21
14
Categories
149
139
35
33
32
Platforms
197
22
7
4
3
Products / Services
10,683
9,759
6,695
4,421
3,750
229
MITRE Techniques
105
80
49
33
31
CVEs
3
3
3
2
1
IDS Classtypes
12
2
1
1
IDS Protocols
9
7
Detects Kerberos TGT and service ticket requests that utilize deprecated or weak encryption types (RC4/DES) often associated with Golden Ticket attacks, specifically in environments where AES is mandated. The rule groups these events by user, service, and IP address to identify potential anomalies indicative of credential forgery.
This rule monitors for potential Kerberos Golden Ticket attacks by detecting specific indicators within Windows security events. It identifies Event ID 4769 with a PAC validation failure status (0x1F), and the use of weak RC4 encryption (0x17) in either TGT requests (Event ID 4768) or service ticket requests (Event ID 4769). These behaviors are often associated with forged Kerberos tickets where the attacker may be using weak encryption or malformed PAC data.
Detects anomalous Kerberos TGS (Ticket Granting Service) requests using weak RC4-HMAC (0x17) encryption. The rule looks for accounts requesting multiple service tickets for distinct Service Principal Names (SPNs) within a short time window, which is a common behavior pattern for tools like Rubeus or GetUserSPNs.py during the credential-harvesting phase of a Kerberoasting attack.
Detects Kerberos service ticket requests (Event ID 4769) that utilize weak RC4 encryption (0x17). This behavior is characteristic of Kerberoasting, where attackers request service tickets for service accounts in order to perform offline brute-force attacks to recover the service account password. The rule filters out machine account requests and focuses on standard user or service account requests.
This rule detects potential attempts to abuse a Trusted Domain Object (TDO) to traverse a one-way Active Directory trust. It identifies suspicious activities such as Kerberos ticket requests (AS-REQ/TGS-REQ) targeting trust accounts (inter-realm indicators) or DCSync-style replication requests targeting the TDO object to extract domain secrets.
Detects a single account requesting an abnormally large number of Kerberos service tickets (Event ID 4769) using weak RC4 encryption (0x17) within a short window. This pattern is characteristic of Kerberoasting attacks, where an adversary requests service tickets for offline password cracking.
Detects Kerberoasting activity by identifying a high volume of RC4-encrypted (0x17) Kerberos Service Ticket (TGS) requests from a single user account against multiple distinct service principal names (SPNs) within a short timeframe. This behavior is highly indicative of automated credential harvesting tools such as Rubeus or Impacket.
Detects anomalous Kerberos ticket requests characteristic of Golden Ticket attacks. These forged tickets are created offline using the KRBTGT account hash, bypassing legitimate KDC TGT issuance, and frequently exhibit default Mimikatz artifacts such as RC4 encryption or extended ticket lifetimes.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
This rule detects instances where a Kerberos Service Ticket (TGS, Event ID 4769) is requested without a corresponding TGT request (AS-REQ, Event ID 4768) from the same user and IP address within a 10-hour window. This behavior is indicative of potential Kerberoasting, where an attacker may have obtained TGS tickets using cached or manually constructed credentials rather than through the normal authentication flow.
This rule detects potential extraction or caching of Kerberos Ticket-Granting Tickets (TGT) by correlating Kerberos authentication events (4768/4769) with unauthorized access to the Local Security Authority Subsystem Service (lsass.exe). This pattern is often indicative of credential dumping tools like Mimikatz targeting Kerberos tickets on systems potentially used for delegation attacks.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects Kerberos Ticket Granting Service (TGS) requests (Event ID 4769) that use RC4 encryption (0x17). In modern Active Directory environments, RC4 is considered weak and is often explicitly requested by attackers during Kerberoasting to facilitate offline brute-force cracking of service account passwords. The rule excludes common service accounts (e.g., krbtgt, machine accounts) to reduce noise.
Kerberos TGT Request Anomaly Detection
Cortex XDR
This rule detects potential indicators of forged Kerberos Ticket Granting Tickets (Golden Tickets). It monitors Kerberos authentication events (4768 and 4769) for specific anomalies, including ticket requests for non-existent accounts (Status 0x6), suspicious service requests (krbtgt with RC4 encryption), and abnormal ticket option usage, which are common artifacts of credential manipulation and forgery.
AS-REP Roasting Potential Enumeration
Cortex XDR
Detects Kerberos AS-REQ events (Event ID 4768) where accounts with Kerberos pre-authentication disabled successfully request an AS-REP ticket. Attackers exploit these accounts by requesting encrypted AS-REP blobs to perform offline password cracking. The rule flags potential enumeration when multiple unique accounts are targeted from the same source within a short timeframe.
Detects a potential Kerberoasting attempt by identifying a single user or IP requesting multiple RC4-encrypted Ticket Granting Service (TGS) tickets for distinct service accounts within a short timeframe. Kerberoasting involves requesting TGS tickets for service accounts, which are then used for offline brute-force cracking of the service account's password hash.
Detects the addition of a 'msDS-KeyCredentialLink' attribute to an Active Directory object (Event 5136), which is indicative of the Shadow Credentials attack vector, followed by a successful PKINIT authentication (Event 4768) for that account. This combination suggests that an adversary has successfully established persistent access using a forged or unauthorized device credential and is now utilizing it for authentication.
Detects successful Kerberos PKINIT authentication (Event 4768, PreAuthType 16) issued by on-premises certificate authorities. This activity is a potential indicator of Shadow Credentials or Active Directory Certificate Services (AD CS) abuse where attackers use forged or stolen certificates to authenticate as domain users or machines.
Page 4 of 11