Uncommon Outbound Kerberos Connection

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•21

Detects uncommon outbound network activity via Kerberos default port (88) indicating possible lateral movement or initial privilege escalation through delegation. The rule specifically filters out common legitimate processes like LSASS, Chrome, Firefox, and Tomcat that might generate similar network activity, aiming to reduce false positives.