NTA Kerberos Service Ticket Harvesting on the Wire
Detects Kerberos service ticket requests observed in network traffic analysis. Seeing this on the wire rather than at the domain controller catches harvesting even where domain controller auditing is incomplete, and it gives the source address directly rather than requiring correlation. Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717). Integration guide: https://bloo.io/docs/integrations BQL (Bloo Query Language): stream=nta-connection where sourcename='NTA' and action='KERBEROS_SERVICE_TICKET_REQUESTED' | duration 1h | groupby srcip, dstip | select srcip, dstip, count(*) as cnt | having cnt > 20
Sigma
