Pass the Ticket - Stolen Kerberos Ticket Lateral Movement Detected
This rule detects potential lateral movement activity by monitoring for Kerberos service ticket requests (Event ID 4769) and Kerberos-based network logons (Event ID 4624, Logon Type 3) originating from source IP addresses that deviate from an account's established baseline of activity over the previous 14 days.
Microsoft Sentinel (KQL)
