Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
229 detections
Filters
Last updated
All Time
Detection languages
92
56
25
20
16
Contributors
63
54
46
21
14
Categories
149
139
35
33
32
Platforms
197
22
7
4
3
Products / Services
10,683
9,759
6,695
4,421
3,750
229
MITRE Techniques
105
80
49
33
31
CVEs
3
3
3
2
1
IDS Classtypes
12
2
1
1
IDS Protocols
9
7
Detects Kerberos service ticket requests (TGS) where the encryption type is set to 0x17 (RC4-HMAC). This is commonly used in Kerberoasting attacks to capture service ticket hashes for offline brute-force attacks.
Detects Kerberos Authentication Service Requests (AS-REQ) where the pre-authentication type is set to 0. This is a characteristic indicator of legacy authentication or potentially malicious activity, such as Kerberoasting or brute-force attempts targeting the authentication service.
Detects Kerberos Authentication Service Requests (AS-REQ) where the pre-authentication type is set to 0. This is a characteristic indicator of legacy authentication or potentially malicious activity, such as Kerberoasting or brute-force attempts targeting the authentication service.
Detects Kerberos realm trust discovery queries
Detects exploitation of Kerberos protocol for credential theft
Detects Silver Ticket attack using forged Kerberos service tickets
This rule detects potential Kerberos Golden Ticket attacks by identifying Kerberos authentication service (AS) request events (EventID 4768) where the ticket encryption type is 0x17 (RC4-HMAC) and the difference between the event generation time and the ticket's start time is greater than one day. This large time difference can indicate a forged ticket with an invalid timestamp, a common characteristic of Golden Tickets. The rule then summarizes these events by target username and computer, flagging instances where three or more such events occur.
Detects Kerberos realm trust discovery queries
Detects exploitation of Kerberos protocol for credential theft
This rule detects potential Kerberos Golden Ticket attacks by identifying Kerberos authentication service (AS) request events (EventID 4768) where the ticket encryption type is 0x17 (RC4-HMAC) and the difference between the event generation time and the ticket's start time is greater than one day. This large time difference can indicate a forged ticket with an invalid timestamp, a common characteristic of Golden Tickets. The rule then summarizes these events by target username and computer, flagging instances where three or more such events occur.
This rule detects Kerberos Domain Trust Discovery attempts by monitoring for a high volume of Kerberos Ticket Granting Ticket (TGT) requests to port 88 (Kerberos) on the home network. A threshold of 20 requests from a single source IP within 10 seconds triggers the alert, indicating a potential network scan activity aimed at mapping domain trusts.
This rule detects potential Golden Ticket attacks by looking for multiple successful Kerberos authentication events (EventID 4624) with LogonType 3 (network logon) and a specific TicketEncryptionType (0x17), originating from the same IP address and targeting the same user, within a short timeframe and with a long ticket lifetime. A Golden Ticket attack involves an adversary forging Kerberos Ticket Granting Tickets (TGTs) to gain unauthorized access to resources.
This rule detects and summarizes Kerberos authentication ticket requests (EventID 4765) and Kerberos authentication ticket request failures (EventID 4766) by subject username on an hourly basis. A high volume of these events for a single user could indicate credential stuffing, brute-force attempts, or other authentication-related anomalies.
This rule detects potential Golden Ticket attacks by looking for multiple successful Kerberos authentication events (EventID 4624) with LogonType 3 (network logon) and a specific TicketEncryptionType (0x17), originating from the same IP address and targeting the same user, within a short timeframe and with a long ticket lifetime. A Golden Ticket attack involves an adversary forging Kerberos Ticket Granting Tickets (TGTs) to gain unauthorized access to resources.
Detects Kerberoasting attack via high-volume Kerberos TGS requests
This rule detects potential Kerberos 'Pass the Ticket' (PtT) attacks, specifically focusing on the reuse of Kerberos Ticket Granting Tickets (TGTs). It triggers when UDP traffic to port 88 (Kerberos) on the home network contains the byte sequence '|6b|' at the beginning of the payload, and this activity occurs 10 times within 5 seconds from the same source IP. The '6b' byte often indicates a Kerberos AP-REQ message, which is used to request access to a service. Repeated AP-REQ messages from the same source could indicate TGT reuse.
This rule detects the use of a Silver Ticket for SMB service authentication. A Silver Ticket is a forged Kerberos service ticket that allows an attacker to authenticate to a specific service (like SMB) on a specific server without needing to interact with the Domain Controller. The rule looks for TCP traffic on port 445 (SMB) containing both 'NTLMSSP' and 'KRB5' content, indicating a Kerberos authentication attempt that might be a Silver Ticket. A threshold is applied to prevent excessive alerts.
This rule detects a Silver Ticket attack, specifically looking for forged Kerberos service tickets. It inspects UDP traffic on port 88 (Kerberos) for specific byte sequences indicative of a forged ticket. The content '|6b|' at depth 1 and '|a0 03 02 01 05|' are specific patterns associated with the structure of a Kerberos ticket, which when combined, suggest a malicious attempt to authenticate to a service without proper credentials.
This rule detects potential Kerberoasting attacks by identifying a high number of Kerberos Ticket-Granting Service (TGS) requests (EventID 4769) for Service Principal Names (SPNs) that are encrypted with RC4 (indicated by TicketOptions containing '0x40810000'). A threshold of 15 or more TGS requests from a single IP address for a target user is used to flag suspicious activity.
This rule detects Kerberoasting activity, specifically looking for multiple Kerberos Ticket Granting Service (TGS) requests over UDP port 88 within a short timeframe from the same source IP. Kerberoasting is a post-exploitation technique used by attackers to obtain service principal name (SPN) hashes, which can then be cracked offline to retrieve the associated plaintext passwords. The rule uses a threshold of 20 TGS requests within 10 seconds from a single source to identify this suspicious behavior.
This rule detects and summarizes Kerberos authentication ticket requests (EventID 4765) and Kerberos authentication ticket request failures (EventID 4766) by subject username on an hourly basis. A high volume of these events for a single user could indicate credential stuffing, brute-force attempts, or other authentication-related anomalies.
Page 7 of 11