T1558.004 - Kerberos AS-REQ Enumeration via High Volume Authentication Requests

0xgrim- K@EsKay

•updated Aug 23, 2026•3•0•16

This detection identifies a single source IP performing high-volume Kerberos AS-REQ authentication attempts against multiple user accounts (>5 unique accounts, >20 total requests), indicating enumeration or brute-force credential access. Attackers use AS-REQ enumeration to discover valid accounts and test credentials before lateral movement or privilege escalation. This pattern is characteristic of 2025 ransomware and APT campaigns targeting Active Directory environments. I generated the telemetry utilizing atomic red team, pc + VM DC