Get-ADUser Enumeration for AS-REP Roasting Vulnerable Accounts

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects PowerShell execution that enumerates Active Directory users with the 'DONT_REQ_PREAUTH' flag set (UserAccountControl flag 4194304). This flag indicates that the account does not require Kerberos pre-authentication, making it vulnerable to AS-REP Roasting attacks where an attacker can request a Ticket Granting Ticket (TGT) without providing credentials and then attempt to crack the hash offline.