Kerberos Unconstrained Delegation Abuse
This Suricata rule detects Kerberos unconstrained delegation abuse by looking for a specific byte sequence in UDP traffic destined for port 88 (Kerberos). The byte sequence '|a0 03 02 01 05 a1 03 02 01 0d|' is indicative of a specific Kerberos message structure that can be associated with unconstrained delegation. Unconstrained delegation allows a service to impersonate any user to any other service on the network, which can be abused by attackers for privilege escalation and lateral movement.
Suricata
