Kerberoasting Detection via Weak Encryption and SPN Fan-out (Zeek)
This rule monitors Kerberos TGS (Ticket-Granting Service) requests for suspicious patterns indicative of Kerberoasting, specifically looking for the use of weak encryption algorithms (RC4 or DES) and high volumes of service ticket requests for unique Service Principal Names (SPNs). It groups activity by source host and time window, flagging activity that involves DES encryption or a significant number of unique SPN requests. Great for detecting kerberoasting activity from unmanaged or rogue devices
Cortex XDR
