Kerberos Service Ticket Requests for the Seamless-SSO Computer Account
This rule detects Kerberos Service Ticket (TGS) requests made for the 'AZUREADSSOACC$' computer account, which is typically used for Seamless Single Sign-On (SSO) in hybrid Azure AD environments. The rule explicitly excludes known Domain Controllers from triggering the alert to focus on potentially suspicious TGS requests originating from other systems.
Microsoft Sentinel (KQL)
