Silver Ticket Forged Service Ticket Detected
This rule detects a Silver Ticket attack, specifically looking for forged Kerberos service tickets. It inspects UDP traffic on port 88 (Kerberos) for specific byte sequences indicative of a forged ticket. The content '|6b|' at depth 1 and '|a0 03 02 01 05|' are specific patterns associated with the structure of a Kerberos ticket, which when combined, suggest a malicious attempt to authenticate to a service without proper credentials.
Suricata
