Weak Encryption Enabled or Pre-Authentication Disabled for User Account

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•6•0•36

Detects when a user account's User Account Control (UAC) flags are modified to enable weak encryption (DES) or disable Kerberos pre-authentication. This configuration can make the account vulnerable to Kerberoasting attacks, where an attacker can request a service ticket for the user and then offline crack the NTLM hash of the user's password if DES encryption is allowed, or if pre-authentication is disabled.