ADAudit Plus Kerberos Ticket Request Anomaly
Detects anomalous Kerberos ticket requests observed by ADAudit Plus. Service ticket harvesting — one account requesting tickets for many services in quick succession — is the precursor to offline cracking of service account credentials, and it is quiet at the domain controller unless something is watching for the pattern. Onboarding: MANAGE-ENGINE-ADAUDIT-PLUS is ingested via Syslog (KV) (Bloo extractor 830). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=win-audit where sourcename='MANAGE-ENGINE-ADAUDIT-PLUS' and action='KERBEROS_AUTHENTICATION_TICKET_REQUESTED' | duration 1h | groupby user, domain | select user, domain, count(*) as cnt | having cnt > 20
Sigma
