AS-REP Roasting - Kerberos Pre-Auth Disabled for User Accounts
Detects Kerberos Authentication Service Requests (AS-REQ) where the pre-authentication type is set to 0. This is a characteristic indicator of legacy authentication or potentially malicious activity, such as Kerberoasting or brute-force attempts targeting the authentication service.
Microsoft Sentinel (KQL)
