All Detections

Uncommon Outbound Kerberos Connection

avatar
SigmaHQ Detections@sigmaHQ
updated Apr 28, 2026000

Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Sigma