Kerberoasting: RC4 service ticket requests across many SPNs by one account

ills3c Intel&Coffee@Ills3C

•updated today•0•0•2

Detects potential Kerberoasting activity where a single account requests RC4-encrypted (0x17) Kerberos service tickets for multiple distinct service accounts within a one-hour window.