ATT&CK T1558.003 - Kerberoasting: Multiple TGS Requests

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects Kerberoasting activity, specifically looking for multiple Kerberos Ticket Granting Service (TGS) requests over UDP port 88 within a short timeframe from the same source IP. Kerberoasting is a post-exploitation technique used by attackers to obtain service principal name (SPN) hashes, which can then be cracked offline to retrieve the associated plaintext passwords. The rule uses a threshold of 20 TGS requests within 10 seconds from a single source to identify this suspicious behavior.