Canary SPN Kerberoasting Detection
Detects Kerberos service ticket requests (TGS) for canary Service Principal Names (SPNs). Any request for a ticket to a canary SPN is highly indicative of a Kerberoasting attack (T1558.003) or other reconnaissance activity, as these accounts have no legitimate purpose. Creation of Canary SPNs can be found here: https://github.com/fluffybunnies-h4x/CyberDeception?tab=readme-ov-file#creating-a-canary-spn-account
Sigma
