PKINIT DC Impersonation from Non-DC Host

chiki briki@ekkor13

•updated Jul 24, 2026•18•2•98

This rule detects potential Kerberos PKINIT (Pre-Authentication Type 16) authentication requests where a Domain Controller account (identified via User Account Control bit 8192) is targeted by an authentication attempt originating from a non-DC client address. This behavior may indicate an attempt to impersonate or misuse a high-privilege account for lateral movement or persistence.