Kerberos Realm Trust Discovery
This rule detects Kerberos Realm Trust Discovery attempts by looking for specific byte patterns in TCP traffic destined for port 88 (Kerberos). The rule triggers if the byte sequence "6b 82" is found within the first 2 bytes of the payload. A threshold is applied to prevent excessive alerts, triggering if 10 such events occur from the same source within 30 seconds.
Suricata
