Best Detection of 2026 Series: Kerberoasting Spike via Abnormal Service Ticket R

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•1

Detects a single account requesting an abnormally high number of distinct Kerberos TGS (Ticket Granting Service) tickets for SPN-mapped accounts within a 15-minute window. This behavior is indicative of Kerberoasting, where an attacker requests service tickets to perform offline brute-force cracking of service account passwords, often used for lateral movement.