Kerberos TGT Request Anomaly Detection
This rule detects potential indicators of forged Kerberos Ticket Granting Tickets (Golden Tickets). It monitors Kerberos authentication events (4768 and 4769) for specific anomalies, including ticket requests for non-existent accounts (Status 0x6), suspicious service requests (krbtgt with RC4 encryption), and abnormal ticket option usage, which are common artifacts of credential manipulation and forgery.
Cortex XDR
