DC machine account PKINIT Kerberos TGT from non-DC workstation (ESC8)

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•6•0•13

Detects certificate-based (PKINIT) Kerberos authentication by a domain controller machine account originating from a non-DC device, which may indicate unauthorized ticket usage or shadow credentials abuse.