AS-REP Roasting Attack - Pre-Auth Not Required

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects an AS-REP Roasting attack where pre-authentication is not required. It specifically looks for UDP traffic on port 88 (Kerberos) containing specific byte sequences associated with this attack technique. The rule uses a threshold to prevent excessive alerts from a single source.