Unusual Number of Kerberos Service Tickets Requested

This analytic identifies an unusual number of Kerberos service ticket requests (Event 4769) from a single host, which can indicate a Kerberoasting attack. It calculates the standard deviation of unique service requests per user and source, using the 3-sigma rule to detect anomalies. Kerberoasting allows adversaries to obtain and crack service tickets offline, potentially leading to privileged access and escalation within an Active Directory environment.