Kerberos Golden Ticket: Anomalous TGT Lifetime/Renewal (4768/4769)
Detects the issuance or renewal of Kerberos Ticket-Granting Tickets (TGT) (Event IDs 4768 and 4769) where the ticket lifetime or renewal duration exceeds standard Windows domain Kerberos policy defaults (typically 10 hours for lifetime and 7 days for renewal). Deviations from these standard thresholds are common indicators of forged Golden Tickets created using an exfiltrated KRBTGT hash.
YARA-L
